Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
run0796.exe

Overview

General Information

Sample name:run0796.exe
Analysis ID:1530692
MD5:6e912c37e25ed34d27440036de24c71a
SHA1:8d2173a6e5239616f131c3c72b6572c56123dac1
SHA256:6e120026e8e7473a4d12f13a157c773b82a04fe90a841d9a8c46da438a8bb58d
Tags:exeuser-QuangNguyen
Infos:

Detection

Score:29
Range:0 - 100
Whitelisted:false
Confidence:40%

Signatures

Found pyInstaller with non standard icon
Binary contains a suspicious time stamp
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
PE file contains sections with non-standard names
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • run0796.exe (PID: 6472 cmdline: "C:\Users\user\Desktop\run0796.exe" MD5: 6E912C37E25ED34D27440036DE24C71A)
    • conhost.exe (PID: 6500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • run0796.exe (PID: 6632 cmdline: "C:\Users\user\Desktop\run0796.exe" MD5: 6E912C37E25ED34D27440036DE24C71A)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results
Source: run0796.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1681336615.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-locale-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1681552537.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-runtime-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-handle-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1678885962.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-handle-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-file-l1-2-0.pdb source: run0796.exe, 00000000.00000003.1678682813.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.0.dr
Source: Binary string: C:\A\21\b\bin\amd64\_socket.pdb source: run0796.exe, run0796.exe, 00000002.00000002.1692291900.00007FFE13271000.00000040.00000001.01000000.00000007.sdmp
Source: Binary string: ucrtbase.pdb source: run0796.exe, 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmp, ucrtbase.dll.0.dr
Source: Binary string: api-ms-win-core-memory-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1679281369.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-memory-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-debug-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1678411716.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-debug-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-synch-l1-2-0.pdb source: run0796.exe, 00000000.00000003.1680583247.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-synch-l1-2-0.dll.0.dr
Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1680647486.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1681198263.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1679539476.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processenvironment-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1678262675.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-datetime-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1681612849.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-stdio-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1680904078.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-conio-l1-1-0.dll.0.dr
Source: Binary string: C:\A\21\b\bin\amd64\python38.pdb source: run0796.exe, 00000002.00000002.1691664835.00007FFDFB75D000.00000040.00000001.01000000.00000005.sdmp
Source: Binary string: api-ms-win-crt-math-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1681416886.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-math-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-localization-l1-2-0.pdb source: run0796.exe, 00000000.00000003.1679187945.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.0.dr
Source: Binary string: api-ms-win-core-heap-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1678976772.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-heap-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: run0796.exe, 00000000.00000003.1679696975.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source: Binary string: api-ms-win-core-util-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1680805677.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-util-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1679428367.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-namedpipe-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-synch-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1680502072.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-synch-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1681137160.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-environment-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1681805406.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-utility-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1679919709.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1680723879.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-timezone-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-string-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1680096274.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-string-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1678508272.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-errorhandling-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-file-l2-1-0.pdb source: run0796.exe, 00000000.00000003.1678781344.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l2-1-0.dll.0.dr
Source: Binary string: vcruntime140.amd64.pdbGCTL source: run0796.exe, 00000000.00000003.1677458140.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmp, VCRUNTIME140.dll.0.dr
Source: Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1679621455.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-process-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1681487748.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-process-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-console-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1678150888.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1679107388.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-libraryloader-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-file-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1678587999.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1681028597.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-convert-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1679035664.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source: Binary string: C:\A\21\b\bin\amd64\select.pdb source: run0796.exe, run0796.exe, 00000002.00000002.1692491940.00007FFE148E1000.00000040.00000001.01000000.00000008.sdmp
Source: Binary string: api-ms-win-core-profile-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1679820104.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.0.dr
Source: Binary string: ucrtbase.pdbUGP source: run0796.exe, 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmp, ucrtbase.dll.0.dr
Source: Binary string: vcruntime140.amd64.pdb source: run0796.exe, 00000000.00000003.1677458140.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmp, VCRUNTIME140.dll.0.dr
Source: Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1681252863.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-heap-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-string-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1681675476.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-string-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-time-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1681742787.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-time-l1-1-0.dll.0.dr
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F196888 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF60F196888
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F1A0A44 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF60F1A0A44
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F1869F0 FindFirstFileExW,FindClose,0_2_00007FF60F1869F0
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F196888 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF60F196888
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F196888 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,2_2_00007FF60F196888
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F1A0A44 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,2_2_00007FF60F1A0A44
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F1869F0 FindFirstFileExW,FindClose,2_2_00007FF60F1869F0
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F196888 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,2_2_00007FF60F196888
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE013C2DFC FindFirstFileExW,2_2_00007FFE013C2DFC
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE013EEFEC FindFirstFileExW,FindClose,FindNextFileW,2_2_00007FFE013EEFEC
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE132763D8 recv,2_2_00007FFE132763D8
Source: run0796.exe, 00000000.00000003.1677944411.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682202100.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677740906.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678031196.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682715900.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682381381.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677849666.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677629022.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681918413.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1683177471.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682715900.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, python38.dll.0.dr, select.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _hashlib.pyd.0.dr, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: run0796.exe, 00000000.00000003.1677944411.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682202100.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677740906.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678031196.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682715900.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682381381.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677849666.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677629022.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681918413.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1683177471.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677740906.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682715900.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, python38.dll.0.dr, select.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _hashlib.pyd.0.dr, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: run0796.exe, 00000000.00000003.1681552537.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679696975.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680096274.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681612849.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678411716.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678976772.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681487748.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679281369.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680723879.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681416886.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681675476.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679428367.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680805677.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679919709.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680502072.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678262675.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680647486.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678885962.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678150888.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679539476.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681137160.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: run0796.exe, 00000000.00000003.1681552537.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679696975.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680096274.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681612849.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678411716.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678976772.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681487748.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679281369.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680723879.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681416886.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681675476.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679428367.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680805677.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679919709.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680502072.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678262675.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680647486.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678885962.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678150888.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679539476.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681137160.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: run0796.exe, 00000000.00000003.1677458140.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.mic
Source: run0796.exe, 00000000.00000003.1681742787.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.sectigo.com/
Source: run0796.exe, 00000000.00000003.1681742787.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681552537.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679696975.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680096274.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681612849.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678411716.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681552537.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678976772.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681487748.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679281369.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680723879.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681416886.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678587999.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681675476.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679428367.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680805677.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679621455.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679919709.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680502072.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679820104.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678262675.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: run0796.exe, 00000000.00000003.1677944411.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682202100.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677740906.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678031196.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682715900.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682381381.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677849666.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677629022.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681918413.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1683177471.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, python38.dll.0.dr, select.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _hashlib.pyd.0.dr, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.drString found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: run0796.exe, 00000000.00000003.1681675476.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.usert
Source: run0796.exe, 00000000.00000003.1681675476.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.usertrtok
Source: run0796.exe, 00000000.00000003.1681675476.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.usertrtokstrtok_sucrtbase.strtok_sstrxfrmucrtbase.strxfrmtolowerucrtbase.tolowertoupperuc
Source: run0796.exe, 00000000.00000003.1677944411.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682202100.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677740906.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678031196.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682715900.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682381381.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677849666.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677629022.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681918413.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1683177471.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682715900.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, python38.dll.0.dr, select.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _hashlib.pyd.0.dr, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: run0796.exe, 00000000.00000003.1681552537.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679696975.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680096274.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681612849.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678411716.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678976772.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681487748.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679281369.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680723879.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681416886.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681675476.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679428367.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680805677.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679919709.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680502072.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678262675.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680647486.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678885962.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678150888.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679539476.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681137160.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: run0796.exe, 00000000.00000003.1681552537.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679696975.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680096274.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681612849.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678411716.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678976772.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681487748.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679281369.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680723879.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681416886.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681675476.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679428367.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680805677.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679919709.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680502072.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678262675.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680647486.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678885962.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678150888.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679539476.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681137160.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: run0796.exe, 00000000.00000003.1677944411.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682202100.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677740906.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678031196.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682715900.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682381381.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677849666.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677629022.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681918413.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1683177471.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677740906.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682715900.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, python38.dll.0.dr, select.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _hashlib.pyd.0.dr, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.drString found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: run0796.exe, 00000000.00000003.1677944411.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682202100.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677740906.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678031196.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682715900.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682381381.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677849666.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677629022.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681918413.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1683177471.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682715900.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, python38.dll.0.dr, select.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _hashlib.pyd.0.dr, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.drString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: run0796.exe, 00000000.00000003.1681552537.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679696975.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680096274.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681612849.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678411716.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678976772.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681487748.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679281369.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680723879.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681416886.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681675476.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679428367.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680805677.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679919709.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680502072.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678262675.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680647486.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678885962.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678150888.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679539476.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681137160.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: run0796.exe, 00000000.00000003.1677944411.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682202100.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677740906.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678031196.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682715900.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682381381.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677849666.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677629022.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681918413.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1683177471.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677740906.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682715900.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, python38.dll.0.dr, select.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _hashlib.pyd.0.dr, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.drString found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: run0796.exe, 00000000.00000003.1681742787.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681552537.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679696975.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680096274.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681612849.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678411716.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681552537.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678976772.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681487748.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679281369.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680723879.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681416886.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678587999.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680647486.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681675476.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679428367.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680805677.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679621455.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679919709.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679107388.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680502072.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: run0796.exe, 00000000.00000003.1678587999.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert
Source: run0796.exe, 00000000.00000003.1681552537.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679696975.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680096274.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681612849.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678411716.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678976772.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681487748.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679281369.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680723879.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681416886.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681675476.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679428367.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680805677.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679919709.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680502072.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678262675.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680647486.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678885962.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678150888.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679539476.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681137160.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
Source: run0796.exe, 00000000.00000003.1681552537.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679696975.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680096274.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681612849.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678411716.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678976772.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681487748.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679281369.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680723879.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681416886.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681675476.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679428367.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680805677.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679919709.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680502072.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678262675.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680647486.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678885962.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678150888.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679539476.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681137160.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
Source: run0796.exe, 00000000.00000003.1677944411.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682202100.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677740906.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678031196.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682715900.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682381381.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677849666.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677629022.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681918413.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1683177471.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682715900.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, python38.dll.0.dr, select.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _hashlib.pyd.0.dr, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.drString found in binary or memory: http://ocsp.digicert.com0C
Source: run0796.exe, 00000000.00000003.1677944411.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682202100.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677740906.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678031196.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682715900.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682381381.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677849666.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677629022.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681918413.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1683177471.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677740906.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682715900.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, python38.dll.0.dr, select.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _hashlib.pyd.0.dr, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.drString found in binary or memory: http://ocsp.digicert.com0N
Source: run0796.exe, 00000000.00000003.1681742787.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681552537.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679696975.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680096274.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681612849.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678411716.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681552537.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678976772.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681487748.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679281369.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680723879.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681416886.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678587999.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680647486.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681675476.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679428367.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680805677.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679621455.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679919709.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679107388.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680502072.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.sectigo.com0
Source: run0796.exe, 00000000.00000003.1677944411.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682202100.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677740906.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678031196.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682715900.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682381381.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677849666.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677629022.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681918413.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1683177471.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, python38.dll.0.dr, select.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _hashlib.pyd.0.dr, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.drString found in binary or memory: http://ocsp.thawte.com0
Source: run0796.exe, 00000002.00000002.1691664835.00007FFDFB75D000.00000040.00000001.01000000.00000005.sdmpString found in binary or memory: http://python.org/dev/peps/pep-0263/
Source: run0796.exe, 00000000.00000003.1677944411.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682202100.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677740906.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678031196.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682715900.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682381381.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677849666.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677629022.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681918413.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1683177471.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, python38.dll.0.dr, select.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _hashlib.pyd.0.dr, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.drString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: run0796.exe, 00000000.00000003.1677944411.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682202100.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677740906.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678031196.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682715900.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682381381.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677849666.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677629022.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681918413.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1683177471.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, python38.dll.0.dr, select.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _hashlib.pyd.0.dr, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.drString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: run0796.exe, 00000000.00000003.1677944411.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682202100.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677740906.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678031196.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682715900.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682381381.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677849666.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677629022.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681918413.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1683177471.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, python38.dll.0.dr, select.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _hashlib.pyd.0.dr, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.drString found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: run0796.exe, 00000000.00000003.1681552537.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679696975.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680096274.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681612849.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678411716.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678976772.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681487748.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679281369.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680723879.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681416886.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681675476.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679428367.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680805677.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679919709.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680502072.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678262675.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680647486.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678885962.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678150888.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679539476.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681137160.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
Source: run0796.exe, 00000000.00000003.1681742787.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681552537.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679696975.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678976772.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680096274.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678411716.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681612849.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678411716.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681552537.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678976772.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680723879.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681487748.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679281369.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678781344.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680723879.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681416886.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678587999.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680647486.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681675476.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679428367.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680805677.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.eclipse.org/0
Source: run0796.exe, 00000002.00000003.1687968485.000001AA09DAE000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1687917821.000001AA09D83000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.drString found in binary or memory: http://www.python.org/
Source: run0796.exe, 00000000.00000003.1683564349.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.drString found in binary or memory: http://www.python.org/dev/peps/pep-0205/
Source: run0796.exe, 00000002.00000002.1691089775.000001AA0A490000.00000004.00001000.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1687549544.000001AA09DB5000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.drString found in binary or memory: http://www.python.org/download/releases/2.3/mro/.
Source: base_library.zip.0.drString found in binary or memory: http://www.robotstxt.org/norobots-rfc.txt
Source: run0796.exe, 00000002.00000003.1689777496.000001AA09DCD000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1689693482.000001AA09DCD000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1688367932.000001AA09D71000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1687263356.000001AA09D6B000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1688342137.000001AA09D9D000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000002.1690470228.000001AA09D7F000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1688953295.000001AA09D72000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1688481101.000001AA09DA0000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1689983516.000001AA09D7C000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1689837022.000001AA09D76000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1687390844.000001AA09D6B000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1688803710.000001AA09DCC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: run0796.exe, 00000002.00000002.1690891791.000001AA0A110000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: run0796.exe, 00000002.00000002.1690879972.000001AA09DCE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: run0796.exe, 00000002.00000003.1689777496.000001AA09DCD000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1689693482.000001AA09DCD000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1688367932.000001AA09D71000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1687263356.000001AA09D6B000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1688342137.000001AA09D9D000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000002.1690470228.000001AA09D7F000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1688953295.000001AA09D72000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1688481101.000001AA09DA0000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1689983516.000001AA09D7C000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1689837022.000001AA09D76000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1687390844.000001AA09D6B000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1688803710.000001AA09DCC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: run0796.exe, 00000002.00000003.1689777496.000001AA09DCD000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1689693482.000001AA09DCD000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1688367932.000001AA09D71000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1687263356.000001AA09D6B000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1688342137.000001AA09D9D000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000002.1690470228.000001AA09D7F000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1688953295.000001AA09D72000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1688481101.000001AA09DA0000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1689983516.000001AA09D7C000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1689837022.000001AA09D76000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1687390844.000001AA09D6B000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1688803710.000001AA09DCC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: run0796.exe, 00000002.00000003.1687968485.000001AA09DAE000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1687917821.000001AA09D83000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.drString found in binary or memory: https://mahler:8092/site-updates.py
Source: run0796.exe, 00000000.00000003.1681742787.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681552537.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679696975.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680096274.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681612849.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678411716.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681552537.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678976772.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681487748.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679281369.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680723879.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681416886.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678587999.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681675476.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679428367.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680805677.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679621455.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679919709.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680502072.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679820104.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678262675.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sectigo.com/CPS0
Source: run0796.exe, 00000000.00000003.1677944411.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682202100.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677740906.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678031196.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682715900.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682381381.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677849666.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677629022.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681918413.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1683177471.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677740906.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682715900.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, python38.dll.0.dr, select.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _hashlib.pyd.0.dr, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.drString found in binary or memory: https://www.digicert.com/CPS0
Source: run0796.exe, 00000000.00000003.1682202100.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.drString found in binary or memory: https://www.openssl.org/H
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F1968880_2_00007FF60F196888
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F1858E00_2_00007FF60F1858E0
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F1A4EB00_2_00007FF60F1A4EB0
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F1A5DFC0_2_00007FF60F1A5DFC
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F19FA980_2_00007FF60F19FA98
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F1A58B00_2_00007FF60F1A58B0
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F19D8880_2_00007FF60F19D888
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F1A512C0_2_00007FF60F1A512C
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F19710C0_2_00007FF60F19710C
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F1907740_2_00007FF60F190774
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F18FF540_2_00007FF60F18FF54
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F194FD00_2_00007FF60F194FD0
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F1916D40_2_00007FF60F1916D4
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F1966D40_2_00007FF60F1966D4
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F1905700_2_00007FF60F190570
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F19CD740_2_00007FF60F19CD74
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F18FD500_2_00007FF60F18FD50
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F19FA980_2_00007FF60F19FA98
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F1A2DC00_2_00007FF60F1A2DC0
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F1926240_2_00007FF60F192624
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F198D100_2_00007FF60F198D10
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F1903640_2_00007FF60F190364
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F19133C0_2_00007FF60F19133C
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F1874300_2_00007FF60F187430
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F1A8BF80_2_00007FF60F1A8BF8
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F1A325C0_2_00007FF60F1A325C
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F1A0A440_2_00007FF60F1A0A44
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F1901600_2_00007FF60F190160
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F1921EC0_2_00007FF60F1921EC
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F1968880_2_00007FF60F196888
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F192A280_2_00007FF60F192A28
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F19D2080_2_00007FF60F19D208
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F1A4EB02_2_00007FF60F1A4EB0
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F1A5DFC2_2_00007FF60F1A5DFC
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F1A58B02_2_00007FF60F1A58B0
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F1968882_2_00007FF60F196888
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F19D8882_2_00007FF60F19D888
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F1858E02_2_00007FF60F1858E0
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F1A512C2_2_00007FF60F1A512C
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F19710C2_2_00007FF60F19710C
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F1907742_2_00007FF60F190774
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F18FF542_2_00007FF60F18FF54
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F194FD02_2_00007FF60F194FD0
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F1916D42_2_00007FF60F1916D4
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F1966D42_2_00007FF60F1966D4
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F1905702_2_00007FF60F190570
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F19CD742_2_00007FF60F19CD74
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F18FD502_2_00007FF60F18FD50
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F19FA982_2_00007FF60F19FA98
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F1A2DC02_2_00007FF60F1A2DC0
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F1926242_2_00007FF60F192624
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F198D102_2_00007FF60F198D10
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F1903642_2_00007FF60F190364
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F19133C2_2_00007FF60F19133C
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F1874302_2_00007FF60F187430
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F1A8BF82_2_00007FF60F1A8BF8
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F1A325C2_2_00007FF60F1A325C
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F1A0A442_2_00007FF60F1A0A44
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F19FA982_2_00007FF60F19FA98
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F1901602_2_00007FF60F190160
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F1921EC2_2_00007FF60F1921EC
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F1968882_2_00007FF60F196888
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F192A282_2_00007FF60F192A28
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F19D2082_2_00007FF60F19D208
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE0138423C2_2_00007FFE0138423C
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE0138B0B02_2_00007FFE0138B0B0
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE013891202_2_00007FFE01389120
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE0139D4082_2_00007FFE0139D408
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE0138A4002_2_00007FFE0138A400
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE0139641C2_2_00007FFE0139641C
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE013822A42_2_00007FFE013822A4
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE0140B2AC2_2_00007FFE0140B2AC
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE013922F02_2_00007FFE013922F0
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE013A05802_2_00007FFE013A0580
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE013A654C2_2_00007FFE013A654C
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE013AC5702_2_00007FFE013AC570
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE013947882_2_00007FFE01394788
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE013957B82_2_00007FFE013957B8
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE013887D02_2_00007FFE013887D0
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE013C26942_2_00007FFE013C2694
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE013826A02_2_00007FFE013826A0
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE0139C6B02_2_00007FFE0139C6B0
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE013886502_2_00007FFE01388650
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE013AD6E02_2_00007FFE013AD6E0
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE013E46F82_2_00007FFE013E46F8
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE013839842_2_00007FFE01383984
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE0142495C2_2_00007FFE0142495C
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE0139195E2_2_00007FFE0139195E
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE01385A202_2_00007FFE01385A20
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE013EEA3C2_2_00007FFE013EEA3C
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE013EE8642_2_00007FFE013EE864
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE01382B902_2_00007FFE01382B90
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE0138BBB02_2_00007FFE0138BBB0
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE013AAB552_2_00007FFE013AAB55
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE0138DC302_2_00007FFE0138DC30
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE0139CAE42_2_00007FFE0139CAE4
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE01381AF82_2_00007FFE01381AF8
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE013A8D502_2_00007FFE013A8D50
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE013ABE102_2_00007FFE013ABE10
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE01396E302_2_00007FFE01396E30
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE013EDDF02_2_00007FFE013EDDF0
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE0139DC602_2_00007FFE0139DC60
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE01388D302_2_00007FFE01388D30
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE013BACC42_2_00007FFE013BACC4
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE01425CC02_2_00007FFE01425CC0
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE013830002_2_00007FFE01383000
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE0138A0302_2_00007FFE0138A030
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE01388EA02_2_00007FFE01388EA0
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE013EEE442_2_00007FFE013EEE44
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE013C2EC02_2_00007FFE013C2EC0
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE0139CEC02_2_00007FFE0139CEC0
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE013ECEC02_2_00007FFE013ECEC0
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE132710002_2_00007FFE13271000
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE132871702_2_00007FFE13287170
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE13273BC02_2_00007FFE13273BC0
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE133071CC2_2_00007FFE133071CC
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE1330D1302_2_00007FFE1330D130
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE148EAB702_2_00007FFE148EAB70
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE148E21C02_2_00007FFE148E21C0
Source: C:\Users\user\Desktop\run0796.exeCode function: String function: 00007FFE13279580 appears 148 times
Source: C:\Users\user\Desktop\run0796.exeCode function: String function: 00007FF60F181CB0 appears 38 times
Source: C:\Users\user\Desktop\run0796.exeCode function: String function: 00007FFE132794D8 appears 35 times
Source: C:\Users\user\Desktop\run0796.exeCode function: String function: 00007FFE01386448 appears 32 times
Source: C:\Users\user\Desktop\run0796.exeCode function: String function: 00007FF60F181C50 appears 90 times
Source: api-ms-win-core-processenvironment-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.0.drStatic PE information: No import functions for PE file found
Source: run0796.exe, 00000000.00000003.1677944411.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs run0796.exe
Source: run0796.exe, 00000000.00000003.1682202100.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibsslH vs run0796.exe
Source: run0796.exe, 00000000.00000003.1677740906.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs run0796.exe
Source: run0796.exe, 00000000.00000003.1681552537.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs run0796.exe
Source: run0796.exe, 00000000.00000003.1679696975.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs run0796.exe
Source: run0796.exe, 00000000.00000003.1680096274.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs run0796.exe
Source: run0796.exe, 00000000.00000003.1681612849.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs run0796.exe
Source: run0796.exe, 00000000.00000003.1678411716.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs run0796.exe
Source: run0796.exe, 00000000.00000003.1678976772.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs run0796.exe
Source: run0796.exe, 00000000.00000003.1681487748.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs run0796.exe
Source: run0796.exe, 00000000.00000003.1679281369.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs run0796.exe
Source: run0796.exe, 00000000.00000003.1680723879.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs run0796.exe
Source: run0796.exe, 00000000.00000003.1681416886.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs run0796.exe
Source: run0796.exe, 00000000.00000003.1677458140.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dll^ vs run0796.exe
Source: run0796.exe, 00000000.00000003.1678031196.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs run0796.exe
Source: run0796.exe, 00000000.00000003.1681675476.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs run0796.exe
Source: run0796.exe, 00000000.00000003.1679428367.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs run0796.exe
Source: run0796.exe, 00000000.00000003.1680805677.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs run0796.exe
Source: run0796.exe, 00000000.00000003.1682715900.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs run0796.exe
Source: run0796.exe, 00000000.00000003.1679919709.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs run0796.exe
Source: run0796.exe, 00000000.00000003.1680502072.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs run0796.exe
Source: run0796.exe, 00000000.00000003.1677849666.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs run0796.exe
Source: run0796.exe, 00000000.00000003.1678262675.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs run0796.exe
Source: run0796.exe, 00000000.00000003.1680647486.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs run0796.exe
Source: run0796.exe, 00000000.00000003.1677629022.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs run0796.exe
Source: run0796.exe, 00000000.00000003.1678885962.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs run0796.exe
Source: run0796.exe, 00000000.00000003.1678150888.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs run0796.exe
Source: run0796.exe, 00000000.00000003.1679539476.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs run0796.exe
Source: run0796.exe, 00000000.00000003.1681137160.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs run0796.exe
Source: run0796.exe, 00000000.00000003.1679107388.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs run0796.exe
Source: run0796.exe, 00000000.00000003.1681252863.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs run0796.exe
Source: run0796.exe, 00000000.00000003.1683177471.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs run0796.exe
Source: run0796.exe, 00000000.00000003.1681742787.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs run0796.exe
Source: run0796.exe, 00000000.00000003.1681805406.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs run0796.exe
Source: run0796.exe, 00000000.00000003.1678508272.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs run0796.exe
Source: run0796.exe, 00000000.00000003.1679035664.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs run0796.exe
Source: run0796.exe, 00000000.00000003.1682880825.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameucrtbase.dllj% vs run0796.exe
Source: run0796.exe, 00000000.00000003.1679187945.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs run0796.exe
Source: run0796.exe, 00000000.00000003.1680583247.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs run0796.exe
Source: run0796.exe, 00000000.00000003.1681028597.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs run0796.exe
Source: run0796.exe, 00000000.00000003.1681198263.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs run0796.exe
Source: run0796.exe, 00000000.00000003.1679820104.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs run0796.exe
Source: run0796.exe, 00000000.00000003.1681336615.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs run0796.exe
Source: run0796.exe, 00000000.00000003.1678781344.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs run0796.exe
Source: run0796.exe, 00000000.00000003.1679621455.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs run0796.exe
Source: run0796.exe, 00000000.00000003.1680904078.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs run0796.exe
Source: run0796.exe, 00000000.00000003.1678682813.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs run0796.exe
Source: run0796.exe, 00000000.00000003.1678587999.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs run0796.exe
Source: run0796.exeBinary or memory string: OriginalFilename vs run0796.exe
Source: run0796.exe, 00000002.00000003.1687263356.000001AA09D6B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamekernel32j% vs run0796.exe
Source: run0796.exe, 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: OriginalFilenamevcruntime140.dll^ vs run0796.exe
Source: run0796.exe, 00000002.00000002.1692369518.00007FFE13288000.00000004.00000001.01000000.00000007.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs run0796.exe
Source: run0796.exe, 00000002.00000003.1687390844.000001AA09D6B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamekernel32j% vs run0796.exe
Source: run0796.exe, 00000002.00000003.1686458281.000001AA09D6F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamekernel32j% vs run0796.exe
Source: run0796.exe, 00000002.00000002.1692113514.00007FFDFB89F000.00000004.00000001.01000000.00000005.sdmpBinary or memory string: OriginalFilenamepython38.dll. vs run0796.exe
Source: run0796.exe, 00000002.00000002.1692562185.00007FFE148EC000.00000004.00000001.01000000.00000008.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs run0796.exe
Source: run0796.exe, 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpBinary or memory string: OriginalFilenameucrtbase.dllj% vs run0796.exe
Source: run0796.exe, 00000002.00000003.1686711023.000001AA09D6F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamekernel32j% vs run0796.exe
Source: libcrypto-1_1.dll.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9987125577836082
Source: libssl-1_1.dll.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9899651759530792
Source: python38.dll.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.999172404661017
Source: unicodedata.pyd.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9939845202137546
Source: classification engineClassification label: sus29.winEXE@4/51@0/0
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F186680 GetLastError,FormatMessageW,WideCharToMultiByte,0_2_00007FF60F186680
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6500:120:WilError_03
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722Jump to behavior
Source: run0796.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\run0796.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: run0796.exeString found in binary or memory: can't send non-None value to a just-started generator
Source: run0796.exeString found in binary or memory: --help
Source: run0796.exeString found in binary or memory: --help
Source: C:\Users\user\Desktop\run0796.exeFile read: C:\Users\user\Desktop\run0796.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\run0796.exe "C:\Users\user\Desktop\run0796.exe"
Source: C:\Users\user\Desktop\run0796.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\run0796.exeProcess created: C:\Users\user\Desktop\run0796.exe "C:\Users\user\Desktop\run0796.exe"
Source: C:\Users\user\Desktop\run0796.exeProcess created: C:\Users\user\Desktop\run0796.exe "C:\Users\user\Desktop\run0796.exe"Jump to behavior
Source: C:\Users\user\Desktop\run0796.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\run0796.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Users\user\Desktop\run0796.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\run0796.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\Desktop\run0796.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\Desktop\run0796.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\run0796.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\run0796.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\run0796.exeFile opened: C:\Users\user\Desktop\pyvenv.cfgJump to behavior
Source: run0796.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: run0796.exeStatic file information: File size 5364263 > 1048576
Source: run0796.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: run0796.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: run0796.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: run0796.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: run0796.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: run0796.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: run0796.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: run0796.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1681336615.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-locale-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1681552537.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-runtime-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-handle-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1678885962.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-handle-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-file-l1-2-0.pdb source: run0796.exe, 00000000.00000003.1678682813.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.0.dr
Source: Binary string: C:\A\21\b\bin\amd64\_socket.pdb source: run0796.exe, run0796.exe, 00000002.00000002.1692291900.00007FFE13271000.00000040.00000001.01000000.00000007.sdmp
Source: Binary string: ucrtbase.pdb source: run0796.exe, 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmp, ucrtbase.dll.0.dr
Source: Binary string: api-ms-win-core-memory-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1679281369.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-memory-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-debug-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1678411716.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-debug-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-synch-l1-2-0.pdb source: run0796.exe, 00000000.00000003.1680583247.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-synch-l1-2-0.dll.0.dr
Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1680647486.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1681198263.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-filesystem-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1679539476.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processenvironment-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1678262675.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-datetime-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1681612849.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-stdio-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1680904078.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-conio-l1-1-0.dll.0.dr
Source: Binary string: C:\A\21\b\bin\amd64\python38.pdb source: run0796.exe, 00000002.00000002.1691664835.00007FFDFB75D000.00000040.00000001.01000000.00000005.sdmp
Source: Binary string: api-ms-win-crt-math-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1681416886.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-math-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-localization-l1-2-0.pdb source: run0796.exe, 00000000.00000003.1679187945.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.0.dr
Source: Binary string: api-ms-win-core-heap-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1678976772.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-heap-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: run0796.exe, 00000000.00000003.1679696975.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.0.dr
Source: Binary string: api-ms-win-core-util-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1680805677.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-util-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1679428367.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-namedpipe-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-synch-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1680502072.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-synch-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1681137160.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-environment-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1681805406.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-utility-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1679919709.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1680723879.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-timezone-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-string-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1680096274.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-string-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1678508272.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-errorhandling-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-file-l2-1-0.pdb source: run0796.exe, 00000000.00000003.1678781344.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l2-1-0.dll.0.dr
Source: Binary string: vcruntime140.amd64.pdbGCTL source: run0796.exe, 00000000.00000003.1677458140.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmp, VCRUNTIME140.dll.0.dr
Source: Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1679621455.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-process-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1681487748.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-process-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-console-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1678150888.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1679107388.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-libraryloader-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-file-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1678587999.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1681028597.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-convert-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1679035664.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.0.dr
Source: Binary string: C:\A\21\b\bin\amd64\select.pdb source: run0796.exe, run0796.exe, 00000002.00000002.1692491940.00007FFE148E1000.00000040.00000001.01000000.00000008.sdmp
Source: Binary string: api-ms-win-core-profile-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1679820104.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.0.dr
Source: Binary string: ucrtbase.pdbUGP source: run0796.exe, 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmp, ucrtbase.dll.0.dr
Source: Binary string: vcruntime140.amd64.pdb source: run0796.exe, 00000000.00000003.1677458140.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmp, VCRUNTIME140.dll.0.dr
Source: Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1681252863.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-heap-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-string-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1681675476.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-string-l1-1-0.dll.0.dr
Source: Binary string: api-ms-win-crt-time-l1-1-0.pdb source: run0796.exe, 00000000.00000003.1681742787.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-time-l1-1-0.dll.0.dr
Source: run0796.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: run0796.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: run0796.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: run0796.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: run0796.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: api-ms-win-core-file-l1-1-0.dll.0.drStatic PE information: 0xC4F451B9 [Sun Sep 16 17:54:01 2074 UTC]
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE13287170 EntryPoint,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,2_2_00007FFE13287170
Source: run0796.exeStatic PE information: section name: _RDATA
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE013A44F9 push rdi; ret 2_2_00007FFE013A4502
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE013A983D push rdi; ret 2_2_00007FFE013A9844
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE013A4A15 push rdi; ret 2_2_00007FFE013A4A1B
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE013A9F52 push rdi; ret 2_2_00007FFE013A9F56
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE1330CB1B push rbp; retf 2_2_00007FFE1330CB28
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1

Persistence and Installation Behavior

barindex
Found pyInstaller with non standard icon
Source: C:\Users\user\Desktop\run0796.exeProcess created: "C:\Users\user\Desktop\run0796.exe"
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-file-l1-2-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-errorhandling-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-crt-runtime-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\_bz2.pydJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-namedpipe-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\_socket.pydJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-crt-math-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-profile-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\libcrypto-1_1.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-crt-conio-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-console-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-file-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-crt-heap-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\_hashlib.pydJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\_ssl.pydJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-crt-filesystem-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-processthreads-l1-1-1.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-synch-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-crt-environment-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\select.pydJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-datetime-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\unicodedata.pydJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\ucrtbase.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\libssl-1_1.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-processthreads-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-sysinfo-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-crt-convert-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-handle-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\_lzma.pydJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-debug-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-timezone-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\python38.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-libraryloader-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-crt-locale-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-util-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-crt-stdio-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-crt-process-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-crt-utility-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-crt-string-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-file-l2-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-synch-l1-2-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-localization-l1-2-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-interlocked-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\VCRUNTIME140.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-crt-time-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-processenvironment-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-memory-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-rtlsupport-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-string-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-heap-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F1850B0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00007FF60F1850B0
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-crt-runtime-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-file-l1-2-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-errorhandling-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\_bz2.pydJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\_socket.pydJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-namedpipe-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-crt-math-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-profile-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\libcrypto-1_1.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-crt-conio-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-console-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-file-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-crt-heap-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\_hashlib.pydJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-crt-filesystem-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\_ssl.pydJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-processthreads-l1-1-1.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-synch-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-crt-environment-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\select.pydJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-datetime-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\unicodedata.pydJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\libssl-1_1.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-processthreads-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-sysinfo-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-crt-convert-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-handle-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-debug-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\_lzma.pydJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-timezone-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\python38.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-libraryloader-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-crt-locale-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-util-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-crt-stdio-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-crt-utility-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-crt-process-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-crt-string-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-file-l2-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-localization-l1-2-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-synch-l1-2-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-interlocked-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-crt-time-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-processenvironment-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-memory-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-rtlsupport-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-string-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-heap-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\run0796.exeAPI coverage: 3.3 %
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F196888 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF60F196888
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F1A0A44 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF60F1A0A44
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F1869F0 FindFirstFileExW,FindClose,0_2_00007FF60F1869F0
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F196888 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF60F196888
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F196888 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,2_2_00007FF60F196888
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F1A0A44 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,2_2_00007FF60F1A0A44
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F1869F0 FindFirstFileExW,FindClose,2_2_00007FF60F1869F0
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F196888 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,2_2_00007FF60F196888
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE013C2DFC FindFirstFileExW,2_2_00007FFE013C2DFC
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE013EEFEC FindFirstFileExW,FindClose,FindNextFileW,2_2_00007FFE013EEFEC
Source: run0796.exe, 00000002.00000003.1688367932.000001AA09D71000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1689189339.000001AA09D8C000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1688953295.000001AA09D72000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000002.1690694229.000001AA09D8F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F199C54 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF60F199C54
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE13287170 EntryPoint,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,2_2_00007FFE13287170
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F1A2630 GetProcessHeap,0_2_00007FF60F1A2630
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F199C54 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF60F199C54
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F18ABE4 SetUnhandledExceptionFilter,0_2_00007FF60F18ABE4
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F18AA3C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF60F18AA3C
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F18A190 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00007FF60F18A190
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F199C54 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FF60F199C54
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F18ABE4 SetUnhandledExceptionFilter,2_2_00007FF60F18ABE4
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F18AA3C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FF60F18AA3C
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FF60F18A190 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FF60F18A190
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE013C22DC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFE013C22DC
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE013ECC28 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFE013ECC28
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE13273AD4 SetUnhandledExceptionFilter,2_2_00007FFE13273AD4
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE13273E0E SetUnhandledExceptionFilter,2_2_00007FFE13273E0E
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE13279040 SetUnhandledExceptionFilter,2_2_00007FFE13279040
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE132738EC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFE132738EC
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE1330D414 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00007FFE1330D414
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE148E1EEC IsProcessorFeaturePresent,00007FFE1330CEB0,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,00007FFE1330CEB0,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFE148E1EEC
Source: C:\Users\user\Desktop\run0796.exeProcess created: C:\Users\user\Desktop\run0796.exe "C:\Users\user\Desktop\run0796.exe"Jump to behavior
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F1A8A40 cpuid 0_2_00007FF60F1A8A40
Source: C:\Users\user\Desktop\run0796.exeCode function: GetPrimaryLen,EnumSystemLocalesW,2_2_00007FFE013EB074
Source: C:\Users\user\Desktop\run0796.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,2_2_00007FFE013EB62C
Source: C:\Users\user\Desktop\run0796.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,2_2_00007FFE013EB4B8
Source: C:\Users\user\Desktop\run0796.exeCode function: GetProcAddress,GetLocaleInfoW,2_2_00007FFE01383AE0
Source: C:\Users\user\Desktop\run0796.exeCode function: EnterCriticalSection,EnumSystemLocalesW,LeaveCriticalSection,2_2_00007FFE013E8FB8
Source: C:\Users\user\Desktop\run0796.exeCode function: EnumSystemLocalesW,2_2_00007FFE013EAF64
Source: C:\Users\user\Desktop\run0796.exeCode function: GetPrimaryLen,EnumSystemLocalesW,2_2_00007FFE013EAFC4
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\ucrtbase.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\Desktop VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\Desktop\run0796.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\Desktop\run0796.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\_socket.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\Desktop\run0796.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI64722\select.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F18A920 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF60F18A920
Source: C:\Users\user\Desktop\run0796.exeCode function: 0_2_00007FF60F1A4EB0 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,0_2_00007FF60F1A4EB0
Source: C:\Users\user\Desktop\run0796.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE1327622C listen,2_2_00007FFE1327622C
Source: C:\Users\user\Desktop\run0796.exeCode function: 2_2_00007FFE132720F0 htons,htonl,bind,htons,2_2_00007FFE132720F0

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Command and Scripting Interpreter		1
DLL Side-Loading		11
Process Injection		11
Process Injection		OS Credential Dumping2
System Time Discovery		Remote Services1
Archive Collected Data		1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault Accounts1
Native API		Boot or Logon Initialization Scripts1
DLL Side-Loading		1
Deobfuscate/Decode Files or Information		LSASS Memory21
Security Software Discovery		Remote Desktop ProtocolData from Removable Media1
Ingress Tool Transfer		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)21
Obfuscated Files or Information		Security Account Manager1
File and Directory Discovery		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook11
Software Packing		NTDS33
System Information Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
Timestomp		LSA SecretsInternet Connection DiscoverySSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
DLL Side-Loading		Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1530692 Sample: run0796.exe Startdate: 10/10/2024 Architecture: WINDOWS Score: 29 5 run0796.exe 53 2->5         started        file3 13 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 5->13 dropped 15 C:\Users\user\AppData\Local\...\ucrtbase.dll, PE32+ 5->15 dropped 17 C:\Users\user\AppData\Local\...\select.pyd, PE32+ 5->17 dropped 19 47 other files (none is malicious) 5->19 dropped 21 Found pyInstaller with non standard icon 5->21 9 run0796.exe 1 5->9         started        11 conhost.exe 5->11         started        signatures4 process5

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
run0796.exe4%VirustotalBrowse

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Temp\_MEI64722\VCRUNTIME140.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI64722\VCRUNTIME140.dll0%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI64722\_bz2.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI64722\_bz2.pyd1%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI64722\_hashlib.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI64722\_hashlib.pyd0%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI64722\_lzma.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI64722\_lzma.pyd1%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI64722\_socket.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI64722\_socket.pyd1%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI64722\_ssl.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI64722\_ssl.pyd0%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-console-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-console-l1-1-0.dll0%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-datetime-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-datetime-l1-1-0.dll0%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-debug-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-debug-l1-1-0.dll0%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-errorhandling-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-errorhandling-l1-1-0.dll0%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-file-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-file-l1-1-0.dll0%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-file-l1-2-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-file-l1-2-0.dll0%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-file-l2-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-file-l2-1-0.dll0%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-handle-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-handle-l1-1-0.dll0%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-heap-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-heap-l1-1-0.dll0%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-interlocked-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-interlocked-l1-1-0.dll0%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-libraryloader-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-libraryloader-l1-1-0.dll0%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-localization-l1-2-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-localization-l1-2-0.dll0%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-memory-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-memory-l1-1-0.dll0%VirustotalBrowse

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://sectigo.com/CPS00%URL Reputationsafe
http://ocsp.sectigo.com00%URL Reputationsafe
http://ocsp.thawte.com00%URL Reputationsafe
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t0%URL Reputationsafe
http://crl.thawte.com/ThawteTimestampingCA.crl00%URL Reputationsafe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#0%URL Reputationsafe
https://www.openssl.org/H0%URL Reputationsafe
http://www.eclipse.org/00%VirustotalBrowse
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L6880%VirustotalBrowse
http://www.robotstxt.org/norobots-rfc.txt0%VirustotalBrowse
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader0%VirustotalBrowse
http://www.python.org/0%VirustotalBrowse
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#0%VirustotalBrowse
http://python.org/dev/peps/pep-0263/0%VirustotalBrowse
http://www.python.org/download/releases/2.3/mro/.0%VirustotalBrowse
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy0%VirustotalBrowse
http://crl.sectigo.com/0%VirustotalBrowse
http://www.python.org/dev/peps/pep-0205/0%VirustotalBrowse
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py0%VirustotalBrowse

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
http://crl.usertrtokrun0796.exe, 00000000.00000003.1681675476.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpfalse
    		unknown
    https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688run0796.exe, 00000002.00000002.1690891791.000001AA0A110000.00000004.00001000.00020000.00000000.sdmpfalseunknown
    http://python.org/dev/peps/pep-0263/run0796.exe, 00000002.00000002.1691664835.00007FFDFB75D000.00000040.00000001.01000000.00000005.sdmpfalseunknown
    http://www.eclipse.org/0run0796.exe, 00000000.00000003.1681742787.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681552537.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679696975.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678976772.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680096274.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678411716.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681612849.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678411716.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681552537.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678976772.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680723879.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681487748.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679281369.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678781344.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680723879.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681416886.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678587999.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680647486.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681675476.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679428367.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680805677.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpfalseunknown
    https://mahler:8092/site-updates.pyrun0796.exe, 00000002.00000003.1687968485.000001AA09DAE000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1687917821.000001AA09D83000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.drfalse
      		unknown
      https://sectigo.com/CPS0run0796.exe, 00000000.00000003.1681742787.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681552537.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679696975.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680096274.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681612849.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678411716.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681552537.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678976772.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681487748.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679281369.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680723879.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681416886.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678587999.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681675476.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679428367.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680805677.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679621455.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679919709.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680502072.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679820104.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678262675.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpfalse
      • URL Reputation: safe
      		unknown
      http://crl.usertrtokstrtok_sucrtbase.strtok_sstrxfrmucrtbase.strxfrmtolowerucrtbase.tolowertoupperucrun0796.exe, 00000000.00000003.1681675476.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpfalse
        		unknown
        http://www.robotstxt.org/norobots-rfc.txtbase_library.zip.0.drfalseunknown
        http://ocsp.sectigo.com0run0796.exe, 00000000.00000003.1681742787.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681552537.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679696975.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680096274.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681612849.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678411716.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681552537.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678976772.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681487748.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679281369.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680723879.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681416886.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678587999.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680647486.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681675476.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679428367.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680805677.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679621455.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679919709.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679107388.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680502072.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpfalse
        • URL Reputation: safe
        		unknown
        http://ocsp.thawte.com0run0796.exe, 00000000.00000003.1677944411.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682202100.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677740906.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678031196.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682715900.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682381381.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677849666.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677629022.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681918413.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1683177471.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, python38.dll.0.dr, select.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _hashlib.pyd.0.dr, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.drfalse
        • URL Reputation: safe
        		unknown
        http://www.python.org/run0796.exe, 00000002.00000003.1687968485.000001AA09DAE000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1687917821.000001AA09D83000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.drfalseunknown
        https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readerrun0796.exe, 00000002.00000003.1689777496.000001AA09DCD000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1689693482.000001AA09DCD000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1688367932.000001AA09D71000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1687263356.000001AA09D6B000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1688342137.000001AA09D9D000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000002.1690470228.000001AA09D7F000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1688953295.000001AA09D72000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1688481101.000001AA09DA0000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1689983516.000001AA09D7C000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1689837022.000001AA09D76000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1687390844.000001AA09D6B000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1688803710.000001AA09DCC000.00000004.00000020.00020000.00000000.sdmpfalseunknown
        http://crl.micrun0796.exe, 00000000.00000003.1677458140.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpfalse
          		unknown
          https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#run0796.exe, 00000002.00000003.1689777496.000001AA09DCD000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1689693482.000001AA09DCD000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1688367932.000001AA09D71000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1687263356.000001AA09D6B000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1688342137.000001AA09D9D000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000002.1690470228.000001AA09D7F000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1688953295.000001AA09D72000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1688481101.000001AA09DA0000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1689983516.000001AA09D7C000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1689837022.000001AA09D76000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1687390844.000001AA09D6B000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1688803710.000001AA09DCC000.00000004.00000020.00020000.00000000.sdmpfalseunknown
          http://www.python.org/download/releases/2.3/mro/.run0796.exe, 00000002.00000002.1691089775.000001AA0A490000.00000004.00001000.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1687549544.000001AA09DB5000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.drfalseunknown
          http://crl.usertrun0796.exe, 00000000.00000003.1681675476.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpfalse
            		unknown
            https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_syrun0796.exe, 00000002.00000003.1689777496.000001AA09DCD000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1689693482.000001AA09DCD000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1688367932.000001AA09D71000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1687263356.000001AA09D6B000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1688342137.000001AA09D9D000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000002.1690470228.000001AA09D7F000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1688953295.000001AA09D72000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1688481101.000001AA09DA0000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1689983516.000001AA09D7C000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1689837022.000001AA09D76000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1687390844.000001AA09D6B000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000002.00000003.1688803710.000001AA09DCC000.00000004.00000020.00020000.00000000.sdmpfalseunknown
            http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0trun0796.exe, 00000000.00000003.1681742787.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681552537.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679696975.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680096274.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681612849.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678411716.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681552537.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678976772.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681487748.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679281369.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680723879.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681416886.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678587999.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681675476.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679428367.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680805677.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679621455.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679919709.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680502072.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679820104.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678262675.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpfalse
            • URL Reputation: safe
            		unknown
            http://ocsp.digicertrun0796.exe, 00000000.00000003.1678587999.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpfalse
              		unknown
              http://crl.sectigo.com/run0796.exe, 00000000.00000003.1681742787.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpfalseunknown
              http://crl.thawte.com/ThawteTimestampingCA.crl0run0796.exe, 00000000.00000003.1677944411.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682202100.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677740906.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678031196.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682715900.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1682381381.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677849666.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1677629022.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681918413.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1683177471.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, python38.dll.0.dr, select.pyd.0.dr, _socket.pyd.0.dr, _ssl.pyd.0.dr, _hashlib.pyd.0.dr, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.dr, _bz2.pyd.0.dr, _lzma.pyd.0.dr, unicodedata.pyd.0.drfalse
              • URL Reputation: safe
              		unknown
              http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#run0796.exe, 00000000.00000003.1681742787.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681552537.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679696975.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680096274.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681612849.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678411716.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681552537.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678976772.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681487748.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679281369.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680723879.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681416886.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1678587999.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680647486.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1681675476.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679428367.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680805677.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679621455.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679919709.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1679107388.000002523F8F7000.00000004.00000020.00020000.00000000.sdmp, run0796.exe, 00000000.00000003.1680502072.000002523F8EA000.00000004.00000020.00020000.00000000.sdmpfalse
              • URL Reputation: safe
              		unknown
              https://www.openssl.org/Hrun0796.exe, 00000000.00000003.1682202100.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, libssl-1_1.dll.0.dr, libcrypto-1_1.dll.0.drfalse
              • URL Reputation: safe
              		unknown
              http://www.python.org/dev/peps/pep-0205/run0796.exe, 00000000.00000003.1683564349.000002523F8EA000.00000004.00000020.00020000.00000000.sdmp, base_library.zip.0.drfalseunknown
              https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.pyrun0796.exe, 00000002.00000002.1690879972.000001AA09DCE000.00000004.00000020.00020000.00000000.sdmpfalseunknown

              World Map of Contacted IPs

              ⊘No contacted IP infos

              General Information

              Joe Sandbox version:41.0.0 Charoite
              Analysis ID:1530692
              Start date and time:2024-10-10 12:02:08 +02:00
              Joe Sandbox product:CloudBasic
              Overall analysis duration:0h 4m 18s
              Hypervisor based Inspection enabled:false
              Report type:full
              Cookbook file name:default.jbs
              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
              Number of analysed new started processes analysed:3
              Number of new started drivers analysed:0
              Number of existing processes analysed:0
              Number of existing drivers analysed:0
              Number of injected processes analysed:0
              Technologies:
              • HCA enabled
              • EGA enabled
              • AMSI enabled
              Analysis Mode:default
              Analysis stop reason:Timeout
              Sample name:run0796.exe
              Detection:SUS
              Classification:sus29.winEXE@4/51@0/0
              EGA Information:
              • Successful, ratio: 100%
              HCA Information:Failed
              Cookbook Comments:
              • Found application associated with file extension: .exe
              • Stop behavior analysis, all processes terminated

              Warnings

              • Not all processes where analyzed, report is missing behavior information
              • Report size exceeded maximum capacity and may have missing disassembly code.

              Simulations

              Behavior and APIs

              ⊘No simulations

              Joe Sandbox View / Context

              IPs

              ⊘No context

              Domains

              ⊘No context

              ASNs

              ⊘No context

              JA3 Fingerprints

              ⊘No context

              Dropped Files

              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
              C:\Users\user\AppData\Local\Temp\_MEI64722\VCRUNTIME140.dllSecuriteInfo.com.Trojan.Siggen29.42959.20394.9110.exeGet hashmaliciousAsyncRAT, MicroClip, PureLog Stealer, RedLineBrowse
                PCUEAYj8Pj.exeGet hashmaliciousAsyncRAT, MicroClip, PureLog Stealer, RedLineBrowse
                  rD5Uox2mkB.exeGet hashmaliciousAsyncRAT, MicroClip, PureLog Stealer, RedLineBrowse
                    MtIILyYuxa.exeGet hashmaliciousUnknownBrowse
                      d2qKVXWmRI.exeGet hashmaliciousUnknownBrowse
                        2SSgZ5GqU5.exeGet hashmaliciousAsyncRAT, MicroClip, PureLog Stealer, RedLineBrowse
                          Google%20Chrome1.exeGet hashmaliciousUnknownBrowse
                            Chrome.exeGet hashmaliciousUnknownBrowse
                              mQcnqAaN5t.exeGet hashmaliciousAsyncRAT, MicroClip, RedLineBrowse
                                ZGxHXcufSf.exeGet hashmaliciousAsyncRAT, MicroClip, PureLog Stealer, RedLineBrowse

                                  Created / dropped Files

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\VCRUNTIME140.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):89752
                                  Entropy (8bit):6.5021374229557996
                                  Encrypted:false
                                  SSDEEP:1536:EFmmAQ77IPzHql9a2k+2v866Xc/0i+N1WtYil42TZiCvecbtjawN+o/J:EQmI+NnXertP42xvecbtjd+ox
                                  MD5:0E675D4A7A5B7CCD69013386793F68EB
                                  SHA1:6E5821DDD8FEA6681BDA4448816F39984A33596B
                                  SHA-256:BF5FF4603557C9959ACEC995653D052D9054AD4826DF967974EFD2F377C723D1
                                  SHA-512:CAE69A90F92936FEBDE67DACD6CE77647CB3B3ED82BB66463CD9047E90723F633AA2FC365489DE09FECDC510BE15808C183B12E6236B0893AF19633F6A670E66
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  • Antivirus: Virustotal, Detection: 0%, Browse
                                  Joe Sandbox View:
                                  • Filename: SecuriteInfo.com.Trojan.Siggen29.42959.20394.9110.exe, Detection: malicious, Browse
                                  • Filename: PCUEAYj8Pj.exe, Detection: malicious, Browse
                                  • Filename: rD5Uox2mkB.exe, Detection: malicious, Browse
                                  • Filename: MtIILyYuxa.exe, Detection: malicious, Browse
                                  • Filename: d2qKVXWmRI.exe, Detection: malicious, Browse
                                  • Filename: 2SSgZ5GqU5.exe, Detection: malicious, Browse
                                  • Filename: Google%20Chrome1.exe, Detection: malicious, Browse
                                  • Filename: Chrome.exe, Detection: malicious, Browse
                                  • Filename: mQcnqAaN5t.exe, Detection: malicious, Browse
                                  • Filename: ZGxHXcufSf.exe, Detection: malicious, Browse
                                  Reputation:moderate, very likely benign file
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............x.D.x.D.x.D..AD.x.D..=D.x.D.x.D.x.Dx..E.x.Dx..E.x.Dx..E.x.Dx..E.x.Dx..E.x.Dx.QD.x.Dx..E.x.DRich.x.D........PE..d....}.Y.........." .........T...............................................`.......Y....`A........................................p...4............@.......0..(.... ...>...P..p.......8...........................@................................................text...$........................... ..`.rdata...6.......8..................@..@.data...0.... ......................@....pdata..(....0......................@..@.rsrc........@......................@..@.reloc..p....P......................@..B................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\_bz2.pyd

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):46664
                                  Entropy (8bit):7.766447771155745
                                  Encrypted:false
                                  SSDEEP:768:J28BQFZi1JKUqxVB4VHOVp6Ej1JxETxcLon5A8DzApS0IG4VAyWDG4yTs:JHBQFZOJKNVB4VHOX6y1JxEtKon5A8BC
                                  MD5:12A39756E876304E73338EA4A103A22B
                                  SHA1:DFFDCCFE8310F823DBBB5CD8BE1E019EE47C518C
                                  SHA-256:FA2A5C074E47CD3348A243A3AD7C87BC60B4073ABFC320271D9BD083917AEA48
                                  SHA-512:5D99CC4D10A08B65A16CFBA43F795FAE0B62AB1F6C1BB1A8755A9B0F87F8DC44B3B9E306EFC8A50EBA9B9DBC433B483F7CD4A2C70CC4587EB1A85492ECA46488
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  • Antivirus: Virustotal, Detection: 1%, Browse
                                  Reputation:low
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........H.1.).b.).b.).b.Qib.).b.A.c.).bM.=b.).b.A.c.).b.A.c.).b.A.c.).bD@.c.).b.O.c.).b.).b.).bD@.c.).bD@.c.).bD@.b.).bD@.c.).bRich.).b................PE..d.....].........." ................@.....................................................`.........................................X...H......|............@..(...................................................@...............................................UPX0....................................UPX1................................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................4.10.UPX!.$..

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\_hashlib.pyd

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):27720
                                  Entropy (8bit):7.442566826937686
                                  Encrypted:false
                                  SSDEEP:384:lnwXNQJMrltGDXzMv7YGY6h/77QZa7gJXePIGsI9lnYPLxDG4y86x+:hwMMJsrAvkKDkpuPIGsI9lWDG4yw
                                  MD5:C7BDD28CD1246C357E437B30F9A9ED5F
                                  SHA1:A12BC40EB8C2CE7F612F7C3EBBBB367E556D5E92
                                  SHA-256:D346215EB358F5998518A24C67C830D1AB1B42D522BE70B3111FD42405BBB615
                                  SHA-512:15CA6B93EE9ABB2D9CAB76C50480D3BFB4DD395A5E7EABB9969B38B62CF82FE6AF01705163CD5C018D4AE1DAC159FB7E1848CE1AEFC5C052AAF627D8A275D6FC
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  • Antivirus: Virustotal, Detection: 0%, Browse
                                  Reputation:low
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2..&v.uv.uv.u...ur.u$..tt.u$..t}.u$..t~.u$..tt.u...tt.u.ts.uv.u..u.tw.u.tw.u.iuw.u.tw.uRichv.u................PE..d.....].........." .....@................................................................`.............................................P...........................................................................................................................UPX0....................................UPX1.....@.......@..................@....rsrc................D..............@......................................................................................................................................................................................................................................................................................................................................................4.10.UPX!.$..

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\_lzma.pyd

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):83528
                                  Entropy (8bit):7.912413306742412
                                  Encrypted:false
                                  SSDEEP:1536:DH927ZDiyANpqVkxHz+aHhcC1WfV357JKjN/a9hGlBt5pZD0RkRgXwek0E8ZSIGL:DC5eqVEHiaHhcC1Wf7Jk6h8lPRgO/8AR
                                  MD5:7C60B9680A1D2D78AD86BCBAC9E10092
                                  SHA1:DC5A5FDD085980AD638E11C612FB505266E09D0D
                                  SHA-256:128A9C2E1C3219A68DF34F9D179B58B45DA6C9436E57F6C2503CB5EF74DCBBF5
                                  SHA-512:CF3E33BF032688D5A2EE132077A2CA9D9FB274F3979AA195801570D726B6F8B86CA6C646C2076446860349FBCDE32BB9D30E04733B890E80B05A709348CCACC0
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  • Antivirus: Virustotal, Detection: 1%, Browse
                                  Reputation:low
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........0d..^7..^7..^7..7..^7.._6..^7..[6..^7..Z6..^7..]6..^7Q._6..^7.._6..^7.._7..^7Q.S6..^7Q.^6..^7Q..7..^7Q.\6..^7Rich..^7........PE..d.....].........." ..... ...................................................@............`.........................................t;..L....9.......0.......................;.......................................)..............................................UPX0....................................UPX1..... ..........................@....rsrc........0....... ..............@..............................................................................................................................................................................................................................................................................................................................................................4.10.UPX!.$..

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\_socket.pyd

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):40008
                                  Entropy (8bit):7.6732513003349245
                                  Encrypted:false
                                  SSDEEP:768:7besQa2/aonoXQH73hWmH646oOjcpwOhIGVwwgxWDG4yMPbi:7besQlnoI8ma4CjXOhIGVwwgsyMPbi
                                  MD5:80E1228E13CE851C468A32CDADE03737
                                  SHA1:C1944A2813E1A650E3F96B79A8CEB3394142B078
                                  SHA-256:70CC97D25C93225E53AA6A8766E3E395EE8463D24EC9718974953EE1B48500FF
                                  SHA-512:5C4865A5A56A2A1367C55474EE356786F56EEB4F00810747FFB3373C1F4DD237C1CF2D9AF2162EF0FFCACEF4A4B3F2C486ECF2E941F88CF61586FFC826211876
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  • Antivirus: Virustotal, Detection: 1%, Browse
                                  Reputation:low
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........1..._..._..._....._...^.._...Z..._...[..._...\.._.a.^.._...^.._...^.B._.a.R..._.a._..._.a..._.a.]..._.Rich.._.................PE..d.....].........." .....p..........pq....................................................`............................................P....................0..............8........................................}..............................................UPX0....................................UPX1.....p.......p..................@....rsrc................t..............@......................................................................................................................................................................................................................................................................................................................................................4.10.UPX!.$..

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\_ssl.pyd

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):50760
                                  Entropy (8bit):7.790116886875569
                                  Encrypted:false
                                  SSDEEP:1536:sbZuwAYgwyBiwFjMLot/OsfHjQIG47AK2yX:st12wyEa+oMqcIG47Au
                                  MD5:D899804D511B77AC0236C52390E84E57
                                  SHA1:6B117E58E03C52DC15D6B1B15BF07DB3912FAD75
                                  SHA-256:630A3CBF877DE5A0DD42FB9787F905A0186797D6E256E9FE0D2B00608A62556F
                                  SHA-512:FBF22E76BD80ADB49819B75890B2E7B2AA6F55FA5D67AD54419237D535DAF85298768904C25B6C28DAFE2138FFC5A48C9C4D6C6514DC229169BF7373EEC39A17
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  • Antivirus: Virustotal, Detection: 0%, Browse
                                  Reputation:low
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t...0.u.0.u.0.u.9...6.u.b.t.2.u.b.p.<.u.b.q.8.u.b.v.2.u..t.6.u.U.t.7.u.0.t.C.u..x.2.u..u.1.u...1.u..w.1.u.Rich0.u.........PE..d.....].........." .................+.......................................P............`..........................................L..d....I.......@.......................M.......................................7..............................................UPX0....................................UPX1................................@....rsrc........@......................@..............................................................................................................................................................................................................................................................................................................................................................4.10.UPX!.$..

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-console-l1-1-0.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):14216
                                  Entropy (8bit):7.0174155073545235
                                  Encrypted:false
                                  SSDEEP:384:2W1hWtiU8JIYiaHZ8ZpH3GCJEJsyxl2rgk/:Ns1YiQZiRBEa03k/
                                  MD5:2E4F85267E771160C79FB0287B8B8EF0
                                  SHA1:7559CFAA8B3318B766A60D88F4864F39BD0FBFC4
                                  SHA-256:08CEAAC727149A83B78A3EA89DED1B502D2C85EE096342466B17DF945D4FBA6C
                                  SHA-512:B0B2A50F80192D9706D2159682425916F28257BB8699CC48466A0A086E7CE4D13684419B010909617B140DE41173752CB7604F6ACB8F221704AC980744872D40
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  • Antivirus: Virustotal, Detection: 0%, Browse
                                  Reputation:low
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d................." .........................................................0.......h....`.........................................`...,............ ...................)..............T............................................................................rdata..,...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-datetime-l1-1-0.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):13704
                                  Entropy (8bit):7.032822365507646
                                  Encrypted:false
                                  SSDEEP:192:2UW1hWaUSwv7s8jtGBIYiYF8oDbnPZ2oEhZnpH3GCwgEfRayHv+JEXD:TW1hWaU8JIYiaHZ8ZpH3GCJEJayP+JEz
                                  MD5:7F8835ACCA566B2FADF1206A5AE9D218
                                  SHA1:90117F6D1EB7520E6EE90DE5DFF3F7FEE7F8C188
                                  SHA-256:F1B65C3E9FB6957DBE07481802B57D737EC9FC2A0797F9C4A9BFB13A5BAA46E0
                                  SHA-512:055A18B3EE0FD661ADBF19411F6287B333953680FCB724D16A22D370054D965990031AFDEE0F6CBCEFEED9CA790BC0F9BBBA177D7D741A369E0F5ACB064682C6
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  • Antivirus: Virustotal, Detection: 0%, Browse
                                  Reputation:low
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d....F.L.........." .........................................................0............`.........................................`................ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-debug-l1-1-0.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):13704
                                  Entropy (8bit):7.034051679366827
                                  Encrypted:false
                                  SSDEEP:192:+W1hWyUSwv7s8jtGBIYiYF8oDbnPZ2oEhZnpH3GCwgEfRqykNBtFLEcj:+W1hWyU8JIYiaHZ8ZpH3GCJEJqykhFhj
                                  MD5:8275A559C686E8DC47687CA0F7ABA0BA
                                  SHA1:5ABD66FDA7CA16EBA90ABBE6ED0C9185F67A12A3
                                  SHA-256:0AD4310AA13F99B7682D43037AF781A5734D4EC566EADBE19D3AD166BFE50B39
                                  SHA-512:E4E217BD5246B0AC7053EE1CBFC08BE5DD07AC679D6F65AE4979E1E23D125D15E8ECCCD39C43800D8DE6DBFD5544159B773F1A97AB14C96D48C1DC3CC07209E6
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  • Antivirus: Virustotal, Detection: 0%, Browse
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d....C............" .........................................................0.......<....`.........................................`................ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-errorhandling-l1-1-0.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):13704
                                  Entropy (8bit):7.081752607443639
                                  Encrypted:false
                                  SSDEEP:384:dBLW1hWHU8JIYiaHZ8ZpH3GCJEJQOxyIVorVoR:dBOrYiQZiRBEJcO
                                  MD5:638C989141351C85D1CC0B334AB687EE
                                  SHA1:8B8DB99B0BBACEC6BE96CEBC19947C280646483E
                                  SHA-256:49DF60FDE25C4D8124EFED8056DB6445BC01A9F2541B1770E8FAEEFB2EF71313
                                  SHA-512:8C583C868246A39C727DB23680E40D4C20D1C9C01C79CC440DB52521CFA8F3FF11B81BFC3C5764F1980D56DB1CF6A15FFBF6AF7C4428FB060B9270546CE638E8
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  • Antivirus: Virustotal, Detection: 0%, Browse
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d.....Z..........." .........................................................0......0.....`.........................................`................ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-file-l1-1-0.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):17288
                                  Entropy (8bit):6.918526561976521
                                  Encrypted:false
                                  SSDEEP:384:6BPvVXcW1hW0OU8JIYiaHZ8ZpH3GCJEJbyYcFZz:aPvVX/xxYiQZiRBE9xE
                                  MD5:2E4988944E2E96EBD5387A1A4DC9E880
                                  SHA1:E991423D119E0E457C1D278664BEBAFC20E239C6
                                  SHA-256:7E3B1CE81E2DC0BA3E725C836765FD9552D5969EAFDB9E3269FE18C56F3F8039
                                  SHA-512:9E3930AA9B016596E4A0DF9ADFD85A2BE52A07F32A42339F503CE5D052CFEA8F3EF6A7B27A6DBC3AD8E7F1A9FFC171A6D7AA9C37194A51B1F1C4B3CB0EC78E56
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  • Antivirus: Virustotal, Detection: 0%, Browse
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d....Q............" .........................................................@............`.........................................`................0...................)..............T............................................................................rdata..............................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-file-l1-2-0.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):13704
                                  Entropy (8bit):7.051877537322967
                                  Encrypted:false
                                  SSDEEP:384:SW1hWnU8JIYiaHZ8ZpH3GCJEJCyZAVjf/f7y:BXYiQZiRBEMqiPO
                                  MD5:C0A08223267DCA75CC2B59D44D58F7BD
                                  SHA1:BC78B24084E11A8A81976F65B2C6AC51FEE0AD6D
                                  SHA-256:7F7AA25F8CF3A6AD223075158FFADECDBB2113F199E78BD96C90E59575C02533
                                  SHA-512:CE78534E2F022806093547DCA1A46995AC9677BC05AAA41718A91B2B68A8EFD30E0612A721C4E8E0A4E5ABCE558BB7A6E24A5430B74885D770A5119293B3B145
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  • Antivirus: Virustotal, Detection: 0%, Browse
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...,,.W.........." .........................................................0.......N....`.........................................`...L............ ...................)..............T............................................................................rdata..H...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-file-l2-1-0.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):13704
                                  Entropy (8bit):7.140886801110957
                                  Encrypted:false
                                  SSDEEP:384:eVrW1hWpU8JIYiaHZ8ZpH3GCJEJHyRQP5:eVuZYiQZiRBEB6+
                                  MD5:756D1BCE2C2FC7E527E48247FD8B3EF4
                                  SHA1:66B26444D249277BBAED0D7F487618795FE91EF4
                                  SHA-256:11A86EDC5CA1D6A83C1D8709F8C3E69D9A1FF763BA85FECD49ADB6647BA0E9A5
                                  SHA-512:78E5BB42CE8CFF66F0E58D865FAED881D1B9214CA1470276BEEB0A7810D5926776E0121F5DBBD7A7F01D0B5ED0A8C0EC57112FCD6FDD45D7A19F39311A2469AC
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  • Antivirus: Virustotal, Detection: 0%, Browse
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...4.F>.........." .........................................................0............`.........................................`................ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-handle-l1-1-0.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):13704
                                  Entropy (8bit):7.055329601565526
                                  Encrypted:false
                                  SSDEEP:384:8W1hWoCU8JIYiaHZ8ZpH3GCJEJ9y2lP/RG:fBYiQZiRBEbDRG
                                  MD5:D574549183528054B01BE86B96F21826
                                  SHA1:AD3BAEC43159A73F88BA8D922286A0F04F40F746
                                  SHA-256:1E08E1CAFC2814E5FDF5DE72D5E4094B1473D48D79F56341D032778D13E0E9B1
                                  SHA-512:DDB7EB111B988D7F26CBE1A0EE326CD2AC49C9A8E7024D23F601E0EBAE2FF1E1CCA494934F2DC36646436315EF9985CC3BC4CFB3AD5827CC302E4B24B5CBE8EA
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  • Antivirus: Virustotal, Detection: 0%, Browse
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d.....QN.........." .........................................................0......H.....`.........................................`...`............ ...................)..............T............................................................................rdata..`...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-heap-l1-1-0.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):14216
                                  Entropy (8bit):7.007995972954854
                                  Encrypted:false
                                  SSDEEP:384:vlgW1hWPU8JIYiaHZ8ZpH3GCJEJXyrkI57:RTYiQZiRBE1Y57
                                  MD5:9445CAC9CEA53F7A2BFEBF5670D48EB6
                                  SHA1:128D651F49795A7A4A52697AFBE4A9E46571D7F6
                                  SHA-256:9588879E9405008D3D87E8EC69ECF651C8C72090E0465F07D6D722BA926F8799
                                  SHA-512:83D6FEB29EE16BE0289D6CFC89E71F2D743C84B3BD66ED207F5804C37BBBC13FA911E7D0C2239D0D90E375B43D3170B948DA70F26563352D672F6C3FD95E25CE
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  • Antivirus: Virustotal, Detection: 0%, Browse
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...T.*..........." .........................................................0............`.........................................`................ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-interlocked-l1-1-0.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):13704
                                  Entropy (8bit):7.0688980162141535
                                  Encrypted:false
                                  SSDEEP:384:dW1hWMU8JIYiaHZ8ZpH3GCJEJBy9K15qv9:0uYiQZiRBE/95M
                                  MD5:B446188BB09EB290BC91E41129BBAD4B
                                  SHA1:C38A367662C3C9FDA1A701BF15C376BF48442134
                                  SHA-256:1CB26D221450861DEEB6C02090CAD937DA106C08C9B07D20A52B4A40C4063D7A
                                  SHA-512:F682AA8783C91C1322DB6C350A4098D24EE8AFF279B81A99AAC488242AADBEB1C994ECB033C82A19364DFE1BFD978E186476D70376C48EAA5BAD8C526921AA0E
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  • Antivirus: Virustotal, Detection: 0%, Browse
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...3Qb..........." .........................................................0......,.....`.........................................`................ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-libraryloader-l1-1-0.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):14728
                                  Entropy (8bit):7.001273656167035
                                  Encrypted:false
                                  SSDEEP:384:uvuBL3BYW1hW+U8JIYiaHZ8ZpH3GCJEJOydabfOhyV:JBL3BTMYiQZiRBEM2bq
                                  MD5:BC94AEA23DFF7CFDD61809EFB9D6B1FA
                                  SHA1:2521909A838941BB7B1AFFCCA3B17BEAF7B3E659
                                  SHA-256:B7E392B2014AAA72F2C7CC40F879148B529F91138F0D9A858C6337C475EAD3E2
                                  SHA-512:94F5C2FAE37F6D8A9A6DAFE579384A8B96647E3CAAC1EF1035D4F42AA81B3141C5865532FF1CDCA6C690C06977365D2B68E806EC3F29EA6E680BDEEFB680F0D0
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  • Antivirus: Virustotal, Detection: 0%, Browse
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...:............." .........................................................0......Ie....`.........................................`................ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-localization-l1-2-0.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):16264
                                  Entropy (8bit):7.034177404129586
                                  Encrypted:false
                                  SSDEEP:384:YOMw3zdp3bwjGjue9/0jCRrndb6kW1hWsU8JIYiaHZ8ZpH3GCJEJNyV4i+:YOMwBprwjGjue9/0jCRrndb0uYiQZiRc
                                  MD5:946B6834271543C2BF51EC8844AA5253
                                  SHA1:69017DADF33E099DA04350C2733479759D5A8CAE
                                  SHA-256:9D4CAEF81CFA17A92D17F4F412BEC75F02C3F36C746C3736374F1BC51CE17154
                                  SHA-512:B8BF7D3CAC6620BB6985E374B7C676AB69401C552D15AD80E527BC791D8DA73EEA5C5F78CF6DA6A20640CE5A63349370C30E2560A0DAAE8CE4382F1AD39D939C
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  • Antivirus: Virustotal, Detection: 0%, Browse
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d.....=X.........." .........................................................0......-.....`.........................................`................ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-memory-l1-1-0.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):14216
                                  Entropy (8bit):7.040938441057245
                                  Encrypted:false
                                  SSDEEP:384:U8W1hWjU8JIYiaHZ8ZpH3GCJEJXyY3eBT:wLYiQZiRBElQ
                                  MD5:939FFD71556467880A01D5A950CDE068
                                  SHA1:EE6ABCAAAEA9FB7919B3D5AA38670AF5317200AE
                                  SHA-256:7D8457E28D11F53D79350F0656188D49042AEA094A8A032F8BEC7B65FBF805EE
                                  SHA-512:7CD6C401EB8580657D34B5F911994FF13910D3D8D510E5ED2237C8FF820902A0126896B0D9500502101568305E9B427997F6D91DA4CD578E45FF12360157A059
                                  Malicious:false
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 0%
                                  • Antivirus: Virustotal, Detection: 0%, Browse
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d....`Z.........." .........................................................0......_K....`.........................................`...l............ ...................)..............T............................................................................rdata..l...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-namedpipe-l1-1-0.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):13704
                                  Entropy (8bit):7.140061654923134
                                  Encrypted:false
                                  SSDEEP:384:OW1hWsU8JIYiaHZ8ZpH3GCJEJjyB40Nox:FKYiQZiRBEBc43x
                                  MD5:24FE695EA91DEB28BD52DFC179AC75F2
                                  SHA1:DE228486DD783D6CF545C5260C2CE4C4102AEC02
                                  SHA-256:7488EB051A42E3F5C11D3F6083D9F5805A35B086600C63885CC8FE6AFAE9CBF9
                                  SHA-512:9A461ABF91EF85520811ADEFBF160B7EA4A9338BE54221A57A990806C4882D2109DD450798AA3D21C3F940FDAC1AD3A1B6A0E0922BBF5E727C0981AC3572CF34
                                  Malicious:false
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...h..&.........." .........................................................0......7.....`.........................................`................ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-processenvironment-l1-1-0.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):14728
                                  Entropy (8bit):7.008102795229075
                                  Encrypted:false
                                  SSDEEP:384:5nW1hW8U8JIYiaHZ8ZpH3GCJEJxyQAHeFCj:EqYiQZiRBErZCj
                                  MD5:52BD42F710986A76F6F23BC90C1DC9BA
                                  SHA1:7D6CADC05343B33C1D1B745E2CFDC0E21BC0FCE1
                                  SHA-256:59EC9C2494ECF3BA1AFCAE6D3EDDF4BE08E8AA307F723BBF8731F673171587A2
                                  SHA-512:F76EDB0D15243DCC1CE5C350E3E4000D7C690B2B28FD714B64968E5487242ADC48EFCD4C669A91956C597D858829891910E34C59DCC5CBE312C3AE90E62D2B38
                                  Malicious:false
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...+;P..........." .........................................................0............`.........................................`...H............ ...................)..............T............................................................................rdata..T...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-processthreads-l1-1-0.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):15752
                                  Entropy (8bit):7.03942394566338
                                  Encrypted:false
                                  SSDEEP:384:tWXk1JzNcKSIXW1hWWU8JIYiaHZ8ZpH3GCJEJAyL5xbx:tbcKSbcYiQZiRBEq45f
                                  MD5:3ECC10492EE3440C642ADCCE55E97305
                                  SHA1:ADC4096F472799802A6050CB4ADDF13BB3E5D63C
                                  SHA-256:381140052908FB4F3932CAF5199ABA971E7FCFFA8970FEF80EACEEAFE9404F1D
                                  SHA-512:2F287482FA5A6891B829E4EE3DB7E48682829FD4E8F3EE9007C0FFA8025B41CEE3F0E1B1AF96AB09CE5A7044905703AC41E4243FBCF37D6F62B21CFC6AE98D4B
                                  Malicious:false
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...m..c.........." .........................................................0......*.....`.........................................`................ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-processthreads-l1-1-1.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):14216
                                  Entropy (8bit):7.070502240135819
                                  Encrypted:false
                                  SSDEEP:384:gtgDfIeFrW1hWvU8JIYiaHZ8ZpH3GCJEJyybVxvh:gpeFuzYiQZiRBE46
                                  MD5:4EFC47CA2D7CCD126D48EF7D1215CB3B
                                  SHA1:1071B4606191D294851EB61B3674CD65E5B7AECA
                                  SHA-256:F898B6033ED993A1D83D095BEFA6F045E8823D13469000D755496EC2FF5CC50F
                                  SHA-512:C8BCB3E890D10FF5902B233BCE8F1CE277E0BF9FCD1F38F7F91F0D2F6A9B3D039016914D44CD860EA8A05D50AF048FB2F60E5848B3FDF056785C7CF8694E0521
                                  Malicious:false
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d................." .........................................................0............`.........................................`................ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-profile-l1-1-0.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):13192
                                  Entropy (8bit):7.180492022182741
                                  Encrypted:false
                                  SSDEEP:384:2yW1hWtU8JIYiaHZ8ZpH3GCJEJiyiXeAF5u:yxYiQZiRBEAdXu
                                  MD5:DAC9191D1E48D2568119CF3CE39CEDBC
                                  SHA1:C8EFE6483BAD06AA2CC0C6065D2B1A039D6496E7
                                  SHA-256:FA05D571233A4BC85637FEE7ED84566E82B99F7E9A435C0B395B231A369B3F15
                                  SHA-512:5196FBA0D42B4B9063F5427BD13BD451AAC089A850B31CF8B7509640FC11A7D7A68098EE77E2ECDB6198A4BF2EE709A04C3C0A5AE3591E29F19FF013E1DF31AF
                                  Malicious:false
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...kl^w.........." .........................................................0.......?....`.........................................`................ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-rtlsupport-l1-1-0.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):14216
                                  Entropy (8bit):7.019072129784289
                                  Encrypted:false
                                  SSDEEP:384:fGeVWW1hWqU8JIYiaHZ8ZpH3GCJEJSyt+t5BW:fGeVtYYiQZiRBEcEOBW
                                  MD5:F738C1AAC72D288F5C43253A7FE9A501
                                  SHA1:A0B9E067DB9CB136EE0D7BAB2DF3F0555D4E079C
                                  SHA-256:B1FA37183D4CA19DD526F642BCFECF7F9854A763041A7C5B45F9827E2D693AF8
                                  SHA-512:6672C0579E5C8041CAAE66B442C6ED891954195AE91EFE139E9CB75E2184750DC0B2FF0995376F668C163E9917845C08B5C852101FC91346B4C5E71AA35952B9
                                  Malicious:false
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...9..\.........." .........................................................0......f=....`.........................................`................ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-string-l1-1-0.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):13704
                                  Entropy (8bit):7.093533659456731
                                  Encrypted:false
                                  SSDEEP:384:RyMvxW1hWKU8JIYiaHZ8ZpH3GCJEJ8yeIBuLzbwY:RyMvgUYiQZiRBE+TI0LHf
                                  MD5:EBA0EC61E69A01EBE32926D84E571D87
                                  SHA1:57D6F7E348619972156EA4CC42E9DF019256E8D4
                                  SHA-256:7D61724110CA87A13FF774B58A08312CCF6F99BF91970CF831DED4708C6DF0B9
                                  SHA-512:E45E492AC039DED781C5311FD1A4288E9A50EAA4EDC0BCA9A7E689C7D7C84D7BB58D7460311EB375ADE7ABD46B070F1EF8DF479B31919F9F322307C7595D9FAD
                                  Malicious:false
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...c`.g.........." .........................................................0...........`.........................................`................ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-synch-l1-1-0.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):15752
                                  Entropy (8bit):6.9628818101862855
                                  Encrypted:false
                                  SSDEEP:384:Kdv3V0dfpkXc0vVaRW1hWRU8JIYiaHZ8ZpH3GCJEJdyxte5019f:Kdv3VqpkXc0vVaAJYiQZiRBEzctea
                                  MD5:ADD6DFC26F77127C05357850EFB0F7CF
                                  SHA1:B716ED833239143169A5E5297A7DAB53926647CE
                                  SHA-256:EE7528903491E96828860C881826E7C0CB605E8E0C3DC2B52EE69B63F454BBAF
                                  SHA-512:8B14D52EFF6A938D63E6DB2F64E57488EC1C76B6447332E3527601A74A5564D6682129FF1F39263A23DD2D15C261AFFF4573A9BBC36D8D053D20A8BA7745E85B
                                  Malicious:false
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d................." .........................................................0............`.........................................`...X............ ...................)..............T............................................................................rdata..X...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-synch-l1-2-0.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):14216
                                  Entropy (8bit):7.104365323176682
                                  Encrypted:false
                                  SSDEEP:384:ltZ3mW1hWOU8JIYiaHZ8ZpH3GCJEJDy4pW/:T8YiQZiRBEBt0
                                  MD5:D7D14C6422E373F626CEEEC6D04E9432
                                  SHA1:A30132FCC2BBAB9090870EA5E3E329D342C4CFA2
                                  SHA-256:04DF3969C51EBB1A05CED4DDB9F780D36B26ADBF5D538800BDC5B2D101782504
                                  SHA-512:D4195F95AEEE8C2AFAEEAA4E609749F4FA2311EC7F9AFEE21C9634D955A62C91D57B55FE21472DF60FBE1E5F0D541809674A52ACBDCD0BC599472565B4482692
                                  Malicious:false
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d......&.........." .........................................................0......P%....`.........................................`...x............ ...................)..............T............................................................................rdata..x...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-sysinfo-l1-1-0.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):14728
                                  Entropy (8bit):7.012830447421948
                                  Encrypted:false
                                  SSDEEP:192:gdKIMF8XW1hWiUSwv7s8jtGBIYiYF8oDbnPZ2oEhZnpH3GCwgEfRFNyuZawbt:kZXW1hWiU8JIYiaHZ8ZpH3GCJEJ3y6aq
                                  MD5:D4413B906754781A1B809F9FA350221E
                                  SHA1:8833348041339BE62811CCD7C04F43EB0731D299
                                  SHA-256:E7995096AF5BD5A84FE82FACF91B028771EF069618BE566F1FB27854E277A190
                                  SHA-512:A7DB754A1E314368F7487B016564E1D52773760139BD36F2BA6890B4B87BB404BFA54A0A3E7F43EB0AF828247064AAA13D496E53DE48C7AF37AF042ACE2874E5
                                  Malicious:false
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...B............." .........................................................0......,.....`.........................................`...H............ ...................)..............T............................................................................rdata..H...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-timezone-l1-1-0.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):14216
                                  Entropy (8bit):7.100845640207154
                                  Encrypted:false
                                  SSDEEP:384:tW1hWBU8JIYiaHZ8ZpH3GCJEJ9yGRO6VTh:kRYiQZiRBEfPbTh
                                  MD5:B47EBDD6D53056C8F47766952EA44D1D
                                  SHA1:7E687C1F75205AE7154A03D7A07AD8B2E3962432
                                  SHA-256:73CEAAA0C05AA62F8629AB074EECE8096F2069C772677763C0D85DBF58B06A4D
                                  SHA-512:C1517A5CF5A58BE9D5CC6B35BFB66D63FAFDAA18F62F74A29F1D50FB36261676C00EBA6C33F4CAC545908EC4D998163FC7F8D59397E5EC044A3284EFB612B8B7
                                  Malicious:false
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...)3............" .........................................................0.......[....`.........................................`...H............ ...................)..............T............................................................................rdata..H...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-core-util-l1-1-0.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):13704
                                  Entropy (8bit):7.041628815802477
                                  Encrypted:false
                                  SSDEEP:384:AVGW1hWLU8JIYiaHZ8ZpH3GCJEJqySABdrv4:ODYiQZiRBEsVQ4
                                  MD5:86C75E0E3C5781D4DE4CF48BBE3BB9AD
                                  SHA1:D32E069FD55D410C50E7F31BB5CE5490385D994D
                                  SHA-256:DB56D1B11DB5F697556EE5CB1A2D03054765881C7DB0081A455B538BD8C75B64
                                  SHA-512:1991019CAB00961A0180115D3F0CD68390BF29D4A733F2E47A56009A33DF48BA450FF49C2E418A1516ABFFC9F968DB560180B822B8135FB186487994E2314E01
                                  Malicious:false
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d....8d..........." .........................................................0.......0....`.........................................`...<............ ...................)..............T............................................................................rdata..8...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-crt-conio-l1-1-0.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):14728
                                  Entropy (8bit):7.042768887277326
                                  Encrypted:false
                                  SSDEEP:384:v1W1hW1U8JIYiaHZ8ZpH3GCJEJCuyDvy0:vMlYiQZiRBEouC
                                  MD5:99405A36355336A5B0FC2D38976FBE34
                                  SHA1:613C9A4FAB9E18AE5C1C0BC35635A339F4175B2B
                                  SHA-256:F3FDDFD86FB29A50D2BE19045F730A7A0D5150E002E8D0BB761383D6927CB017
                                  SHA-512:0A4E126B4F39EF66FBB029F7D251FBFF8D41294386D91A603777440CCE389C9D1857E434E5E5C3067907F92C18D01FDAA62F481944E2878F9A5DD940B40BD96C
                                  Malicious:false
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d....G.#.........." .........................................................0.......R....`.......................................................... ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-crt-convert-l1-1-0.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):17800
                                  Entropy (8bit):6.819176073659551
                                  Encrypted:false
                                  SSDEEP:384:xuyhW1hWtU8JIYiaHZ8ZpH3GCJEJTyxRnV:cBYiQZiRBE9w7
                                  MD5:AFA92B4501D50A4A8842907321D24A3A
                                  SHA1:B7E54E28AA92BA8A2291F823675249BEEE34ACAB
                                  SHA-256:441D48DE10554574382AAEC90F4319024CC4B420FC9C7C46F6E55B69EAF0389D
                                  SHA-512:4DC29AADEDDCBE5A2B9E4C4CF501D08C5A7BCB2F7636691C64A1EFFDBE06822CFB37EF77D181EA9D151A36787E364258E0C25027F695A3BA819931B545752B53
                                  Malicious:false
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d.....(j.........." .........................................................@............`..........................................................0...................)..............T............................................................................rdata..............................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-crt-environment-l1-1-0.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):14216
                                  Entropy (8bit):7.016802714034603
                                  Encrypted:false
                                  SSDEEP:192:vfW1hW9USwv7s8jtGBIYiYF8oDbnPZ2oEhZnpH3GCwgEfRAybgVuQERc:vfW1hW9U8JIYiaHZ8ZpH3GCJEJAyEVj
                                  MD5:E0678146732234884E297D122B77A379
                                  SHA1:51355978B28A14093BEDF854C3EB327F81E35D49
                                  SHA-256:C530E82229B653283AA26DC6E4A9FBDCCA94FB2AA9009229287FA4D14D88B33E
                                  SHA-512:E85D4581D7D36B8D4FF68BC735929228F454E6ECEB4518063C9A7C45A3862F59D2F89367D7D1FB03AA1BD982F2F5E206A508C7ED06AB5073DA945CEE90AF612F
                                  Malicious:false
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d................" .........................................................0............`............................................."............ ...................)..............T............................................................................rdata..2...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-crt-filesystem-l1-1-0.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):15752
                                  Entropy (8bit):7.0276418307282205
                                  Encrypted:false
                                  SSDEEP:384:uq6nWm5CZW1hWFU8JIYiaHZ8ZpH3GCJEJeyHwVeU/:P6nWm5CIhYiQZiRBEoawZ/
                                  MD5:59F114FCAEE18D121A9157A4FBF5CD63
                                  SHA1:FFB167BD1A99BF03F0AD3055B011410EE26912E1
                                  SHA-256:35762CA49FFB0601F452506FCA8159833A836AAB2998C043DA26CEA129B2E0CC
                                  SHA-512:644A173FDB4EA9906311FEB704106D0A138032804C173B9AC9E7E0FA4D6E0A12489AA58C9B59CC25702A312B70F4EE738152D76A79D5D184A5357875D1535675
                                  Malicious:false
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...#..j.........." .........................................................0............`.......................................................... ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-crt-heap-l1-1-0.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):14728
                                  Entropy (8bit):6.985174652816443
                                  Encrypted:false
                                  SSDEEP:384:wY3eBW1hWaU8JIYiaHZ8ZpH3GCJEJ5ye/F2s:IQoYiQZiRBEvP1
                                  MD5:A296F161BC462CF5CBAC3DB1DE896152
                                  SHA1:2AA2866487F092F314C3980112D188BB67FEAEBB
                                  SHA-256:EE2477890551192E1FFDED00B7F52691555257362CA5BE98A885E7563B5A9D8F
                                  SHA-512:35D1D340123AAF7C4BFAC602D3162E8D05839C18A76190176882E846927C960274B24AC688BDAFCCE795AB427A813E9A1E36BFC3C9F9E1C88AFE2CD6236E5D26
                                  Malicious:false
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d.....#..........." .........................................................0............`.......................................................... ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-crt-locale-l1-1-0.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):14216
                                  Entropy (8bit):7.101054839961238
                                  Encrypted:false
                                  SSDEEP:384:+W1hWSU8JIYiaHZ8ZpH3GCJEJjVyaW+x9a:VEYiQZiRBE/0
                                  MD5:F1D3B8FABC8E3F5D2EE1AF7B96DC2AB1
                                  SHA1:ADD58C250C4737F83CAA07B5CB4E5BAE7AC463CF
                                  SHA-256:2D6F62541D5A998BA096655D5E9FADBB256AAD1DD4EC6811089ED5DFC2FC2996
                                  SHA-512:C9543C74723F7F321AB7BE4C16CD508E19EB987DBAAA9AE436CB2F22FD828097CA4FA332B1DF976692FC49794F19F6525B591FE03E81D1E3FE395C499FD16A42
                                  Malicious:false
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d................" .........................................................0.......e....`.............................................e............ ...................)..............T............................................................................rdata..u...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-crt-math-l1-1-0.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):22920
                                  Entropy (8bit):6.546685862284554
                                  Encrypted:false
                                  SSDEEP:384:TQUbM4Oe59Ckb1hgmLNW1hW4U8JIYiaHZ8ZpH3GCJEJiylpd8vYiE:TRMq59Bb1jECYiQZiRBEMm/
                                  MD5:BBB079B564E6370524F79B95B3D18FCB
                                  SHA1:978DB6F13EF785AD9BBDE8B078B7F3247736EAC5
                                  SHA-256:F4709F4CE42DA18A012A5EA643172EE31BA42058D8FA53E1089E9D4D57043522
                                  SHA-512:BD04D57AF9EF0ED86605374B842C207DFE860BE2FCE7EE2FDE276457148A7D8AF58CEA5939DC4A7A91816ADEC40808244F96F139015CA4CCC671B160DD3AD851
                                  Malicious:false
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...+H............" .........,...............................................P.......W....`..............................................%...........@...............0...)..............T............................................................................rdata...&.......(..................@..@.rsrc........@.......,..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-crt-process-l1-1-0.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):14728
                                  Entropy (8bit):7.005157499664524
                                  Encrypted:false
                                  SSDEEP:384:QSKwW1hW6U8JIYiaHZ8ZpH3GCJEJoPy7bvNUYH:QjIYiQZiRBEWPQbbH
                                  MD5:7EB5E7F8F7330FBE45D84591838B48FA
                                  SHA1:D3173386725A755B4451242AAA09086FC8714A5D
                                  SHA-256:E787441815B9A2B04363C4394CFB459451803C9EC8EEBF3942CB2A1C6B86D9A7
                                  SHA-512:070315BF2521625014C98749F35E264B1DF53F28835D31945694B5DD4C261CBEBD22B2574FC0D69ED6F881EEC26B2E6E0FED6DD8907152B8ED360448881AC51E
                                  Malicious:false
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...*j............" .........................................................0............`.............................................x............ ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-crt-runtime-l1-1-0.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):18312
                                  Entropy (8bit):6.82111186841236
                                  Encrypted:false
                                  SSDEEP:384:ZtYr7zW1hWnU8JIYiaHZ8ZpH3GCJEJtyl4mJ:Zmr7WnYiQZiRBELy
                                  MD5:0996C0C41555C946131F35D3F94AE9E2
                                  SHA1:3B79B0F59F908E24C1886EEC882C892681087AB5
                                  SHA-256:AB5FC13C6B5332677DA685A6C5218217169BCD8DE8926575A4EC8C933816105A
                                  SHA-512:5ED3D7B53B8807119ACCE1370CC50F3B59CE2EEE3B8595CBC0277ADF5D4709E9105E156E70241495577E00D9D8A977238E17CED09DE871387AB9A171B7179C51
                                  Malicious:false
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d....V.4.........." .........................................................@............`.............................................4............0...................)..............T............................................................................rdata..D...........................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-crt-stdio-l1-1-0.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):19848
                                  Entropy (8bit):6.753649746969567
                                  Encrypted:false
                                  SSDEEP:384:0ZpFVhHW1hWeU8JIYiaHZ8ZpH3GCJEJoymuLH2n:oowYiQZiRBEiT
                                  MD5:62B2BC705F6885B97E66F1A5874C19C3
                                  SHA1:413A1F93046E810BCEE37E92997BE254B6D0F827
                                  SHA-256:C14B49BCAE64A7F378BDF7ED1967D6BA203107D5500D183F4079ADEB76D4F22C
                                  SHA-512:417DCC39CFD6F773EDA02B2B1EE4C9042F297A7B2E66CBC45415F07D58179C05D86F055AAFC824131C7F5973C5E3955763546133378009ADB367FE6B1E5E25D7
                                  Malicious:false
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d....Z?..........." ......... ...............................................@......c6....`.............................................a............0...............$...)..............T............................................................................rdata..a...........................@..@.rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-crt-string-l1-1-0.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):19848
                                  Entropy (8bit):6.7355545537163195
                                  Encrypted:false
                                  SSDEEP:384:CiFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGlbW1hWlU8JIYiaHZ8ZpH3GCJEJPyampS:C6S5yguNvZ5VQgx3SbwA71IkFhlYiQZH
                                  MD5:E9501EFF2A537703BB135497135CCA30
                                  SHA1:F1ED4C82EC2E10BE0CA0D7CE0DCB006DF1843AA6
                                  SHA-256:40F4176481C7F3733A04577211CB519B4C35AAE943E166471A33D3A83807F712
                                  SHA-512:CFA272F9966259920CF515E928A8459980C71BFEDDBBC93C0A8744D29FB9D25A20298435EEC6355463DFE9DED3F44C04668866EDD556E8BAD67736F177322BA4
                                  Malicious:false
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d...|P=z.........." ......... ...............................................@......vE....`..........................................................0...............$...)..............T............................................................................rdata..............................@..@.rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-crt-time-l1-1-0.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):16264
                                  Entropy (8bit):6.926731414512969
                                  Encrypted:false
                                  SSDEEP:384:EUW1hWLU8JIYiaHZ8ZpH3GCJEJYyDPASn:ojYiQZiRBEmi
                                  MD5:F0CEAF5FF74A71E3372704C21D9CC035
                                  SHA1:4E30B432569656ECB88D2DEB3D4EB800797F9C6D
                                  SHA-256:2CF3736B625FD897BBFAA5F28F3A5B723D7EBF04B88B01899DEF99BC864B127B
                                  SHA-512:0450A1E61FBC0DFDB515AFD3FA6B08CE382DC095E0EA3CB30E90D7A7F98FBF597E2D8CE412A49DEB1B04EB896558B244B6238FB4874DA819885FFC966154F115
                                  Malicious:false
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d................" .........................................................0......Y.....`.......................................................... ...................)..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\api-ms-win-crt-utility-l1-1-0.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):14216
                                  Entropy (8bit):7.088393037131793
                                  Encrypted:false
                                  SSDEEP:384:/fVW1hWbU8JIYiaHZ8ZpH3GCJEJByo2E0is:/fsDYiQZiRBEDlrs
                                  MD5:45262442DFB0743389F390146AFC75FF
                                  SHA1:5BE66BDB1D00F4EBAD7EAFD67FAC2C13E299991A
                                  SHA-256:61EBF1F0263A91EAC9531E556588132F145A448AF57D481D462B09936A600A85
                                  SHA-512:5CC7E61BDC13A0EAFADCBAEBC7322AE1B0B4A47C57791D372A34DAF01AEBEC99F2B651322EE1C875EC3881452B43A800C89F9AD32D38F8DA8FC06DDF1EFF14A7
                                  Malicious:false
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3A..w e.w e.w e..De.v e..Da.u e..D..v e..Dg.v e.Richw e.........PE..d..............." .........................................................0............`.............................................^............ ...................)..............T............................................................................rdata..n...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\base_library.zip

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                  Category:dropped
                                  Size (bytes):1028082
                                  Entropy (8bit):5.501416218831693
                                  Encrypted:false
                                  SSDEEP:24576:fhidpNtosQNRs54PK4IMoVw59bfCEzXxTPEo0nR32x:fhidpNtosQNRs54PK4IM9pTPp01C
                                  MD5:712AF246B95197C33BA75746FDBAE9E8
                                  SHA1:6762F1B0B70DC522AAEE5FE957F2926393F07D7A
                                  SHA-256:80B065F3DA13ED055DF355AA8B894368A28984500AF5FC485F9BDE8623FE29D0
                                  SHA-512:770BACAADDC6225B6ED2B47DD51D5D07C6A1D05267978444F6959196967A4FD47AA2B5194C7433407E35CF4E52E1FCD90FEDF2BCE8905F6409C7CB8C3A98622D
                                  Malicious:false
                                  Preview:PK..........!...7............._bootlocale.pycU....................................@....z...d.Z.d.d.l.Z.d.d.l.Z.e.j...d...r,d.d.d...Z.nJz.e.j...W.n4..e.k.rj......e.e.d...r\d.d.d...Z.n.d.d.d...Z.Y.n.X.d.d.d...Z.d.S.)...A minimal subset of the locale module used at interpreter startup.(imported by the _io module), in order to reduce startup time...Don't import directly from third-party code; use the `locale` module instead!......N..winTc....................C........t.j.j.r.d.S.t.....d...S.).N..UTF-8.........sys..flags..utf8_mode.._locale.._getdefaultlocale....do_setlocale..r......_bootlocale.py..getpreferredencoding...............r......getandroidapilevelc....................C........d.S.).Nr....r....r....r....r....r....r...............c....................C........t.j.j.r.d.S.d.d.l.}.|...|...S.).Nr....r......r....r....r......localer......r....r....r....r....r....r.....................c....................C....6...|.r.t...t.j.j.r.d.S.t...t.j...}.|.s2t.j.d.k.r2d.}.|.S.).Nr......darwin....A

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\libcrypto-1_1.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):1165344
                                  Entropy (8bit):7.943154860736068
                                  Encrypted:false
                                  SSDEEP:24576:mQ1eNb4trV08LfYeMAmnZsMr9BPiNvkNW6Azoa8nuBU9QnC7jHvSZyPEpBY1CPw2:24tJieHmZhZBP+kN8zYuBU9QC7jaMPLo
                                  MD5:E6E16EC7D018DA9F6C3617CC6047B76D
                                  SHA1:4B247D528AF85CB2815526E15A1E74BFDECD8BE7
                                  SHA-256:6C0F5D7EB4BF14CD1B08935728E2847BAC0710ADB53CCF898FE4D7AE088370D7
                                  SHA-512:7774B07A6847EBEE8B0AE39C1D3EB35C7D68B7D602CC9A7D1CE6CCF9BD52D1570183DE96FD9305E6CA85B48CAEF67DF0FD9A9EDC790B094B3C69BA1540467D95
                                  Malicious:false
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........R...3...3...3...K...3..[...3..[...3..[...3..[...3..U...3...3..{3..qZ...3..qZ..1..qZ...3..qZf..3..qZ...3..Rich.3..................PE..d....k.].........." ..............$.@d4...$...................................6...........`......................................... .4.D.....4.h.....4.......1.............d.6......................................p4.............................................UPX0......$.............................UPX1..........$.....................@....rsrc.........4.....................@......................................................................................................................................................................................................................................................................................................................................................4.10.UPX!.$..

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\libssl-1_1.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):200736
                                  Entropy (8bit):7.917418043848761
                                  Encrypted:false
                                  SSDEEP:3072:5lM6bdemhWev84dBLSels63IXDV2q5kkT2131upKtk8rNGAhG6Rda6JwV:U6bdzhb1DubXDQqmkT21lupIpNBaZ
                                  MD5:9B267E2D5FB3FC71107FCC9049A673B2
                                  SHA1:23A3FDBEB3FE931603A09CD14D3ABBC6B22CB78A
                                  SHA-256:4AB239C7DA5D08EDBF05168327B087BD7866D018764AE4E660E05939D6D4FBBE
                                  SHA-512:6361530239E63B189071DC75903F4AC1194BF3D6225B45493D1F10CDE1540BF48EDE0F3AED3202EB24219F632BBF9E8F4FA79FBD120521B29C5C73B7B4D22BF1
                                  Malicious:false
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........8<..YRT.YRT.YRT.!.T.YRT.1SU.YRT.?SU.YRT.1WU.YRT.1VU.YRT.1QU.YRTf0SU.YRT.YST.XRTf0VU.YRTf0RU.YRTf0.T.YRTf0PU.YRTRich.YRT................PE..d....k.].........." .........P...@..@....P...................................P............`.............................................4@.......................K...........F......................................@...............................................UPX0.....@..............................UPX1.........P......................@....rsrc....P.......H..................@......................................................................................................................................................................................................................................................................................................................................................4.10.UPX!.$..

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\python38.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):1420872
                                  Entropy (8bit):7.991145312851321
                                  Encrypted:true
                                  SSDEEP:24576:ERwYj1KTAAsOJxRmtvO3i75n6q0qcDFm8ZNtWTdK158EvnDDHsFr87O+pkMXgVki:dYj1oRsGvZSNtcxTtR1mY/MFr9+pkMXW
                                  MD5:E2C5960438D7CD94B1E09CD2C0026048
                                  SHA1:F7BDCD290D36E47D0AE59181D404A36A47792211
                                  SHA-256:DA55D7935F13BFA55F280B1D12729622F63C841BA181FAB330634D47D51D7A60
                                  SHA-512:965C46ADB518C2F2749BB48EF5A41859C71BCC6ED9EB05A3EE0F6F0C964783E408847F6383BC436E702B62735E006A1B41C441C861A6799B8B824DF1571910A0
                                  Malicious:false
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................................7[.........................................B............c...........Rich............................PE..d.....].........." ............. .. .B..0....................................C...........`.........................................0.B.......B.L.....B.......?.P...........H.C.....................................8.B.............................................UPX0..... ..............................UPX1.........0......................@....rsrc.........B.....................@..............................................................................................................................................................................................................................................................................................................................................4.10.UPX!.$..

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\select.pyd

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):21576
                                  Entropy (8bit):7.2853758582276065
                                  Encrypted:false
                                  SSDEEP:384:nFMvDdZ1QFmOZsRKKc4Za7gJXtjHrIGqG9d7nYPLxDG4y8KxS:nFMvJLkmOsRZXpdjLIGqG9ZWDG4y4
                                  MD5:AF2D6B40BECEAC14D4F5685BDE16DDC1
                                  SHA1:08F4191CDCACED292BF469A8C9E50A8BDE347933
                                  SHA-256:2C774A62073B14944483C89F626F2559F98B29EAD7D66475E40E869337AB5105
                                  SHA-512:E60C51FF6A77267E38B1BD3FCA3ADDE21EEE39D18F9216B1EA0FF7D9DD328ECEEFEC2FE2D6AD40589A22415BDF6CA8A07E784EE9D37766A9DCDF9A62513FA482
                                  Malicious:false
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................)............................M................M......M......M.E....M......Rich...........PE..d.....].........." .....0..........p.....................................................`.........................................\...L.......|............`......................................................................................................UPX0....................................UPX1.....0.......*..................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................4.10.UPX!.$..

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\ucrtbase.dll

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):1011592
                                  Entropy (8bit):6.662485557659338
                                  Encrypted:false
                                  SSDEEP:24576:WkmZDEMHhp9v1Ikbn3ND0TNVOsIut8P4zmxvSZX0yplkf:TmZFHhp9v1Io3h0TN3pvkf
                                  MD5:A4781A4C41ADA12C5420EE2B9BCBFDA3
                                  SHA1:7C394165FAFD176908F38C6C5FFE065751B6A868
                                  SHA-256:0EF5CC705F0752489EA8F2A79116CA842142CEE9F2BBB60EF24E2524B0066A09
                                  SHA-512:0055A67D02C59D5F63A3D7B56FE934AE56A80FC56E11819DE62AE567FCA74724AC6BC885BAC37CD3F11A7ABD243B9990F8EDD674BECD7B7A4F89A3325EBAB104
                                  Malicious:false
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........W..l9F.l9F.l9F...F.l9F.l8F.l9F...F.l9F..9G.l9F..:G.l9F..<G.l9F..7G.n9F..=G.l9F...F.l9F..;G.l9FRich.l9F........PE..d.....}X.........." .........`............................................................`A................................................p......................F...)......p...PX..T............................'...............O...............................text............................... ..`.rdata..<u.......v..................@..@.data....$...........r..............@....pdata.............................@..@.rsrc................4..............@..@.reloc..p............:..............@..B................................................................................................................................................................................................................................................................

                                  C:\Users\user\AppData\Local\Temp\_MEI64722\unicodedata.pyd

                                  Download File
                                  Process:C:\Users\user\Desktop\run0796.exe
                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                  Category:dropped
                                  Size (bytes):286792
                                  Entropy (8bit):7.984977302461466
                                  Encrypted:false
                                  SSDEEP:6144:EWa++XuGxbp8WIgofQm7TuW3R+VXwm0rMIsmdxHYzl:EWnmFbprIgoIYTPhwoI9mdx4zl
                                  MD5:24CB3725B8EFB906E12F4EFEF4BD7CDC
                                  SHA1:CE1102C9DA67B7383870525CB58AD215273EDDDC
                                  SHA-256:6B3C41D359EE40A3FFBBE338A894D79404B973BB9D1AD7D945DF7C0947E1D626
                                  SHA-512:779B71ADE33512E20D5B17F16269A89596C184F17D30569538BEE7CAA6AB2717C6576BB0C5856EDED76AF57DA64A76934FA5B8E6DA4FDF6C21E72C737CC99B09
                                  Malicious:false
                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B.0v..^%..^%..^%.f.%..^%Tv_$..^%Tv[$..^%TvZ$..^%Tv]$..^%.w_$..^%cx_$..^%.._%N.^%.wS$..^%.w^$..^%.w.%..^%.w\$..^%Rich..^%................PE..d.....].........." .....@..........p........................................ ............`.............................................X...................................<.......................................p...............................................UPX0....................................UPX1.....@.......4..................@....rsrc................8..............@......................................................................................................................................................................................................................................................................................................................................................4.10.UPX!.$..

                                  Static File Info

                                  General

                                  File type:PE32+ executable (console) x86-64, for MS Windows
                                  Entropy (8bit):7.984755669621709
                                  TrID:
                                  • Win64 Executable Console (202006/5) 92.65%
                                  • Win64 Executable (generic) (12005/4) 5.51%
                                  • Generic Win/DOS Executable (2004/3) 0.92%
                                  • DOS Executable Generic (2002/1) 0.92%
                                  • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                  File name:run0796.exe
                                  File size:5'364'263 bytes
                                  MD5:6e912c37e25ed34d27440036de24c71a
                                  SHA1:8d2173a6e5239616f131c3c72b6572c56123dac1
                                  SHA256:6e120026e8e7473a4d12f13a157c773b82a04fe90a841d9a8c46da438a8bb58d
                                  SHA512:dc5dabc20ded934cc58b8755844d8b8995f10ac762a5c373da146979153314db925b20aeddbc626ef0f24b0c3f51b856395b281902afd629f878c11785b33872
                                  SSDEEP:98304:FE8ElwP+57GNUOiGyUu+6bDv1v8XUsZ79HMFdV0xyH8iJEWHSyeqX1YIqI:FE9VoFfTu+6bDvlsUs/QV0AHZHSYXV
                                  TLSH:AA463351B39108F8EDBB113EC992D21AE6753C2B0751D84F03F459A7AF23A119E3B761
                                  File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........R........................c...........y.L.....y.......y.......y.......................................Rich...................

                                  File Icon

                                  Icon Hash:2e1e7c4c4c61e979

                                  Static PE Info

                                  General

                                  Entrypoint:0x14000a6b0
                                  Entrypoint Section:.text
                                  Digitally signed:false
                                  Imagebase:0x140000000
                                  Subsystem:windows cui
                                  Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                  DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
                                  Time Stamp:0x650911DA [Tue Sep 19 03:13:30 2023 UTC]
                                  TLS Callbacks:
                                  CLR (.Net) Version:
                                  OS Version Major:5
                                  OS Version Minor:2
                                  File Version Major:5
                                  File Version Minor:2
                                  Subsystem Version Major:5
                                  Subsystem Version Minor:2
                                  Import Hash:ba5546933531fafa869b1f86a4e2a959

                                  Entrypoint Preview

                                  Instruction
                                  dec eax
                                  sub esp, 28h
                                  call 00007FE9B0F5101Ch
                                  dec eax
                                  add esp, 28h
                                  jmp 00007FE9B0F50C1Fh
                                  int3
                                  int3
                                  int3
                                  int3
                                  int3
                                  int3
                                  int3
                                  int3
                                  int3
                                  int3
                                  int3
                                  int3
                                  int3
                                  int3
                                  dec eax
                                  sub esp, 28h
                                  call 00007FE9B0F51564h
                                  test eax, eax
                                  je 00007FE9B0F50DD3h
                                  dec eax
                                  mov eax, dword ptr [00000030h]
                                  dec eax
                                  mov ecx, dword ptr [eax+08h]
                                  jmp 00007FE9B0F50DB7h
                                  dec eax
                                  cmp ecx, eax
                                  je 00007FE9B0F50DC6h
                                  xor eax, eax
                                  dec eax
                                  cmpxchg dword ptr [00041E7Ch], ecx
                                  jne 00007FE9B0F50DA0h
                                  xor al, al
                                  dec eax
                                  add esp, 28h
                                  ret
                                  mov al, 01h
                                  jmp 00007FE9B0F50DA9h
                                  int3
                                  int3
                                  int3
                                  inc eax
                                  push ebx
                                  dec eax
                                  sub esp, 20h
                                  movzx eax, byte ptr [00041E67h]
                                  test ecx, ecx
                                  mov ebx, 00000001h
                                  cmove eax, ebx
                                  mov byte ptr [00041E57h], al
                                  call 00007FE9B0F51363h
                                  call 00007FE9B0F52492h
                                  test al, al
                                  jne 00007FE9B0F50DB6h
                                  xor al, al
                                  jmp 00007FE9B0F50DC6h
                                  call 00007FE9B0F5F871h
                                  test al, al
                                  jne 00007FE9B0F50DBBh
                                  xor ecx, ecx
                                  call 00007FE9B0F524A2h
                                  jmp 00007FE9B0F50D9Ch
                                  mov al, bl
                                  dec eax
                                  add esp, 20h
                                  pop ebx
                                  ret
                                  int3
                                  int3
                                  int3
                                  inc eax
                                  push ebx
                                  dec eax
                                  sub esp, 20h
                                  cmp byte ptr [00041E1Ch], 00000000h
                                  mov ebx, ecx
                                  jne 00007FE9B0F50E19h
                                  cmp ecx, 01h
                                  jnbe 00007FE9B0F50E1Ch
                                  call 00007FE9B0F514CAh
                                  test eax, eax
                                  je 00007FE9B0F50DDAh

                                  Data Directories

                                  NameVirtual AddressVirtual Size Is in Section
                                  IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                  IMAGE_DIRECTORY_ENTRY_IMPORT0x3bb5c0x3c.rdata
                                  IMAGE_DIRECTORY_ENTRY_RESOURCE0x520000xf010.rsrc
                                  IMAGE_DIRECTORY_ENTRY_EXCEPTION0x4e0000x20c4.pdata
                                  IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                  IMAGE_DIRECTORY_ENTRY_BASERELOC0x620000x75c.reloc
                                  IMAGE_DIRECTORY_ENTRY_DEBUG0x393500x1c.rdata
                                  IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                  IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                  IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                  IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x392100x140.rdata
                                  IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                  IMAGE_DIRECTORY_ENTRY_IAT0x2a0000x350.rdata
                                  IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                  IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                  IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                  Sections

                                  NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                  .text0x10000x288a00x28a00cd519058a1cc7a614054b311d84d179bFalse0.5563401442307693zlib compressed data6.490694010276288IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                  .rdata0x2a0000x126e20x128006ac77a035de0924c811c7eda0b3df220False0.5156381967905406data5.846063161745269IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                  .data0x3d0000x103f80xe009bd2cebaa3285e8e266c4c373a15119dFalse0.13337053571428573DOS executable (block device driver \377\3)1.808915577448681IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                  .pdata0x4e0000x20c40x220047e5659f5cd2366c7761336e5e8f1fbdFalse0.4763327205882353data5.30946295758841IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                  _RDATA0x510000x15c0x200739c14bf73dcb926054c7e1038da65e4False0.384765625data2.7733452366771543IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                  .rsrc0x520000xf0100xf2007c3130af8730238e7ffcbe62d30adb45False0.7952285640495868data7.356312649477091IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                  .reloc0x620000x75c0x800b7279c82d58eeae8dc663879402c6f2eFalse0.54296875data5.238892234772638IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                  Resources

                                  NameRVASizeTypeLanguageCountryZLIB Complexity
                                  RT_ICON0x522080xea8Device independent bitmap graphic, 48 x 96 x 8, image size 00.56636460554371
                                  RT_ICON0x530b00x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 00.7287906137184116
                                  RT_ICON0x539580x568Device independent bitmap graphic, 16 x 32 x 8, image size 00.7471098265895953
                                  RT_ICON0x53ec00x909bPNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.9971636186822983
                                  RT_ICON0x5cf5c0x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 00.38309128630705397
                                  RT_ICON0x5f5040x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 00.4826454033771107
                                  RT_ICON0x605ac0x468Device independent bitmap graphic, 16 x 32 x 32, image size 00.699468085106383
                                  RT_GROUP_ICON0x60a140x68data0.7019230769230769
                                  RT_MANIFEST0x60a7c0x592XML 1.0 document, ASCII text, with CRLF line terminators0.4488078541374474

                                  Imports

                                  DLLImport
                                  KERNEL32.dllGetCommandLineW, GetEnvironmentVariableW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, CreateDirectoryW, GetTempPathW, WaitForSingleObject, Sleep, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, LoadLibraryExW, SetConsoleCtrlHandler, FindClose, FindFirstFileExW, CloseHandle, GetCurrentProcess, LocalFree, FormatMessageW, MultiByteToWideChar, WideCharToMultiByte, WriteConsoleW, GetProcAddress, GetModuleFileNameW, SetDllDirectoryW, FreeLibrary, GetLastError, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetModuleHandleW, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, CreateFileW, GetDriveTypeW, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, GetFullPathNameW, RemoveDirectoryW, FindNextFileW, SetStdHandle, DeleteFileW, ReadFile, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW, GetCurrentDirectoryW, FlushFileBuffers, HeapReAlloc, GetFileAttributesExW, GetStringTypeW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, SetEndOfFile
                                  ADVAPI32.dllConvertSidToStringSidW, GetTokenInformation, OpenProcessToken, ConvertStringSecurityDescriptorToSecurityDescriptorW

                                  Network Behavior

                                  ⊘No network behavior found

                                  Statistics

                                  CPU Usage

                                  Click to jump to process

                                  Memory Usage

                                  Click to jump to process

                                  High Level Behavior Distribution

                                  Click to dive into process behavior distribution

                                  Behavior

                                  Click to jump to process

                                  System Behavior

                                  General

                                  Target ID:0
                                  Start time:06:02:59
                                  Start date:10/10/2024
                                  Path:C:\Users\user\Desktop\run0796.exe
                                  Wow64 process (32bit):false
                                  Commandline:"C:\Users\user\Desktop\run0796.exe"
                                  Imagebase:0x7ff60f180000
                                  File size:5'364'263 bytes
                                  MD5 hash:6E912C37E25ED34D27440036DE24C71A
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:C, C++ or other language
                                  Reputation:low
                                  Has exited:true

                                  General

                                  Target ID:1
                                  Start time:06:02:59
                                  Start date:10/10/2024
                                  Path:C:\Windows\System32\conhost.exe
                                  Wow64 process (32bit):false
                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                  Imagebase:0x7ff7699e0000
                                  File size:862'208 bytes
                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:C, C++ or other language
                                  Reputation:high
                                  Has exited:true

                                  General

                                  Target ID:2
                                  Start time:06:03:00
                                  Start date:10/10/2024
                                  Path:C:\Users\user\Desktop\run0796.exe
                                  Wow64 process (32bit):false
                                  Commandline:"C:\Users\user\Desktop\run0796.exe"
                                  Imagebase:0x7ff60f180000
                                  File size:5'364'263 bytes
                                  MD5 hash:6E912C37E25ED34D27440036DE24C71A
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:C, C++ or other language
                                  Reputation:low
                                  Has exited:true

                                  Disassembly

                                  Reset < >

                                    Execution Graph

                                    Execution Coverage:11.7%
                                    Dynamic/Decrypted Code Coverage:0%
                                    Signature Coverage:15.5%
                                    Total number of Nodes:2000
                                    Total number of Limit Nodes:72
                                    execution_graph 18646 7ff60f19e96c 18647 7ff60f19eb5e 18646->18647 18649 7ff60f19e9ae _isindst 18646->18649 18648 7ff60f196098 memcpy_s 11 API calls 18647->18648 18666 7ff60f19eb4e 18648->18666 18649->18647 18652 7ff60f19ea2e _isindst 18649->18652 18650 7ff60f18a110 _wfindfirst32i64 8 API calls 18651 7ff60f19eb79 18650->18651 18667 7ff60f1a5444 18652->18667 18657 7ff60f19eb8a 18659 7ff60f199f40 _wfindfirst32i64 17 API calls 18657->18659 18661 7ff60f19eb9e 18659->18661 18664 7ff60f19ea8b 18664->18666 18691 7ff60f1a5488 18664->18691 18666->18650 18668 7ff60f19ea4c 18667->18668 18669 7ff60f1a5453 18667->18669 18673 7ff60f1a4848 18668->18673 18698 7ff60f19f818 EnterCriticalSection 18669->18698 18674 7ff60f1a4851 18673->18674 18675 7ff60f19ea61 18673->18675 18676 7ff60f196098 memcpy_s 11 API calls 18674->18676 18675->18657 18679 7ff60f1a4878 18675->18679 18677 7ff60f1a4856 18676->18677 18678 7ff60f199f20 _invalid_parameter_noinfo 37 API calls 18677->18678 18678->18675 18680 7ff60f1a4881 18679->18680 18681 7ff60f19ea72 18679->18681 18682 7ff60f196098 memcpy_s 11 API calls 18680->18682 18681->18657 18685 7ff60f1a48a8 18681->18685 18683 7ff60f1a4886 18682->18683 18684 7ff60f199f20 _invalid_parameter_noinfo 37 API calls 18683->18684 18684->18681 18686 7ff60f1a48b1 18685->18686 18687 7ff60f19ea83 18685->18687 18688 7ff60f196098 memcpy_s 11 API calls 18686->18688 18687->18657 18687->18664 18689 7ff60f1a48b6 18688->18689 18690 7ff60f199f20 _invalid_parameter_noinfo 37 API calls 18689->18690 18690->18687 18699 7ff60f19f818 EnterCriticalSection 18691->18699 18759 7ff60f18a440 18760 7ff60f18a450 18759->18760 18776 7ff60f19581c 18760->18776 18762 7ff60f18a45c 18782 7ff60f18a758 18762->18782 18764 7ff60f18aa3c 7 API calls 18766 7ff60f18a4f5 18764->18766 18765 7ff60f18a474 _RTC_Initialize 18774 7ff60f18a4c9 18765->18774 18787 7ff60f18a908 18765->18787 18768 7ff60f18a489 18790 7ff60f197fe0 18768->18790 18774->18764 18775 7ff60f18a4e5 18774->18775 18777 7ff60f19582d 18776->18777 18778 7ff60f196098 memcpy_s 11 API calls 18777->18778 18781 7ff60f195835 18777->18781 18779 7ff60f195844 18778->18779 18780 7ff60f199f20 _invalid_parameter_noinfo 37 API calls 18779->18780 18780->18781 18781->18762 18783 7ff60f18a769 18782->18783 18786 7ff60f18a76e __scrt_acquire_startup_lock 18782->18786 18784 7ff60f18aa3c 7 API calls 18783->18784 18783->18786 18785 7ff60f18a7e2 18784->18785 18786->18765 18815 7ff60f18a8cc 18787->18815 18789 7ff60f18a911 18789->18768 18791 7ff60f198000 18790->18791 18805 7ff60f18a495 18790->18805 18792 7ff60f19801e GetModuleFileNameW 18791->18792 18793 7ff60f198008 18791->18793 18797 7ff60f198049 18792->18797 18794 7ff60f196098 memcpy_s 11 API calls 18793->18794 18795 7ff60f19800d 18794->18795 18796 7ff60f199f20 _invalid_parameter_noinfo 37 API calls 18795->18796 18796->18805 18830 7ff60f197f80 18797->18830 18800 7ff60f198091 18801 7ff60f196098 memcpy_s 11 API calls 18800->18801 18802 7ff60f198096 18801->18802 18803 7ff60f199f88 __free_lconv_mon 11 API calls 18802->18803 18803->18805 18804 7ff60f1980a9 18807 7ff60f198110 18804->18807 18808 7ff60f1980f7 18804->18808 18813 7ff60f1980cb 18804->18813 18805->18774 18814 7ff60f18a9dc InitializeSListHead 18805->18814 18806 7ff60f199f88 __free_lconv_mon 11 API calls 18806->18805 18811 7ff60f199f88 __free_lconv_mon 11 API calls 18807->18811 18809 7ff60f199f88 __free_lconv_mon 11 API calls 18808->18809 18810 7ff60f198100 18809->18810 18812 7ff60f199f88 __free_lconv_mon 11 API calls 18810->18812 18811->18813 18812->18805 18813->18806 18816 7ff60f18a8e6 18815->18816 18818 7ff60f18a8df 18815->18818 18819 7ff60f19905c 18816->18819 18818->18789 18822 7ff60f198c98 18819->18822 18829 7ff60f19f818 EnterCriticalSection 18822->18829 18831 7ff60f197fd0 18830->18831 18832 7ff60f197f98 18830->18832 18831->18800 18831->18804 18832->18831 18833 7ff60f19dec8 memcpy_s 11 API calls 18832->18833 18834 7ff60f197fc6 18833->18834 18835 7ff60f199f88 __free_lconv_mon 11 API calls 18834->18835 18835->18831 18836 7ff60f194340 18837 7ff60f19434b 18836->18837 18845 7ff60f19e4d4 18837->18845 18858 7ff60f19f818 EnterCriticalSection 18845->18858 19076 7ff60f198bc0 19079 7ff60f198b40 19076->19079 19086 7ff60f19f818 EnterCriticalSection 19079->19086 18970 7ff60f1a97a2 18971 7ff60f1a97b1 18970->18971 18972 7ff60f1a97bb 18970->18972 18974 7ff60f19f878 LeaveCriticalSection 18971->18974 15346 7ff60f19fa98 15347 7ff60f19fabc 15346->15347 15349 7ff60f19facc 15346->15349 15348 7ff60f196098 memcpy_s 11 API calls 15347->15348 15371 7ff60f19fac1 15348->15371 15350 7ff60f19fdac 15349->15350 15352 7ff60f19faee 15349->15352 15351 7ff60f196098 memcpy_s 11 API calls 15350->15351 15353 7ff60f19fdb1 15351->15353 15354 7ff60f19fb0f 15352->15354 15501 7ff60f1a0154 15352->15501 15356 7ff60f199f88 __free_lconv_mon 11 API calls 15353->15356 15357 7ff60f19fb81 15354->15357 15359 7ff60f19fb35 15354->15359 15363 7ff60f19fb75 15354->15363 15356->15371 15361 7ff60f19dec8 memcpy_s 11 API calls 15357->15361 15376 7ff60f19fb44 15357->15376 15358 7ff60f19fc2e 15370 7ff60f19fc4b 15358->15370 15377 7ff60f19fc9d 15358->15377 15516 7ff60f19868c 15359->15516 15364 7ff60f19fb97 15361->15364 15363->15358 15363->15376 15522 7ff60f1a653c 15363->15522 15367 7ff60f199f88 __free_lconv_mon 11 API calls 15364->15367 15366 7ff60f199f88 __free_lconv_mon 11 API calls 15366->15371 15372 7ff60f19fba5 15367->15372 15368 7ff60f19fb3f 15373 7ff60f196098 memcpy_s 11 API calls 15368->15373 15369 7ff60f19fb5d 15369->15363 15375 7ff60f1a0154 45 API calls 15369->15375 15374 7ff60f199f88 __free_lconv_mon 11 API calls 15370->15374 15372->15363 15372->15376 15380 7ff60f19dec8 memcpy_s 11 API calls 15372->15380 15373->15376 15378 7ff60f19fc54 15374->15378 15375->15363 15376->15366 15377->15376 15379 7ff60f1a258c 40 API calls 15377->15379 15387 7ff60f19fc59 15378->15387 15558 7ff60f1a258c 15378->15558 15381 7ff60f19fcda 15379->15381 15384 7ff60f19fbc7 15380->15384 15382 7ff60f199f88 __free_lconv_mon 11 API calls 15381->15382 15385 7ff60f19fce4 15382->15385 15389 7ff60f199f88 __free_lconv_mon 11 API calls 15384->15389 15385->15376 15385->15387 15386 7ff60f19fda0 15391 7ff60f199f88 __free_lconv_mon 11 API calls 15386->15391 15387->15386 15392 7ff60f19dec8 memcpy_s 11 API calls 15387->15392 15388 7ff60f19fc85 15390 7ff60f199f88 __free_lconv_mon 11 API calls 15388->15390 15389->15363 15390->15387 15391->15371 15393 7ff60f19fd28 15392->15393 15394 7ff60f19fd30 15393->15394 15395 7ff60f19fd39 15393->15395 15396 7ff60f199f88 __free_lconv_mon 11 API calls 15394->15396 15477 7ff60f19931c 15395->15477 15398 7ff60f19fd37 15396->15398 15404 7ff60f199f88 __free_lconv_mon 11 API calls 15398->15404 15400 7ff60f19fd50 15567 7ff60f1a6654 15400->15567 15401 7ff60f19fddb 15403 7ff60f199f40 _wfindfirst32i64 17 API calls 15401->15403 15406 7ff60f19fdef 15403->15406 15404->15371 15409 7ff60f19fe18 15406->15409 15416 7ff60f19fe28 15406->15416 15407 7ff60f19fd77 15410 7ff60f196098 memcpy_s 11 API calls 15407->15410 15408 7ff60f19fd98 15412 7ff60f199f88 __free_lconv_mon 11 API calls 15408->15412 15411 7ff60f196098 memcpy_s 11 API calls 15409->15411 15413 7ff60f19fd7c 15410->15413 15414 7ff60f19fe1d 15411->15414 15412->15386 15415 7ff60f199f88 __free_lconv_mon 11 API calls 15413->15415 15415->15398 15417 7ff60f1a010b 15416->15417 15418 7ff60f19fe4a 15416->15418 15419 7ff60f196098 memcpy_s 11 API calls 15417->15419 15420 7ff60f19fe67 15418->15420 15486 7ff60f1a023c 15418->15486 15421 7ff60f1a0110 15419->15421 15424 7ff60f19fedb 15420->15424 15426 7ff60f19fe8f 15420->15426 15430 7ff60f19fecf 15420->15430 15423 7ff60f199f88 __free_lconv_mon 11 API calls 15421->15423 15423->15414 15428 7ff60f19ff03 15424->15428 15431 7ff60f19dec8 memcpy_s 11 API calls 15424->15431 15446 7ff60f19fe9e 15424->15446 15425 7ff60f19ff8e 15439 7ff60f19ffab 15425->15439 15447 7ff60f19fffe 15425->15447 15586 7ff60f1986c8 15426->15586 15428->15430 15433 7ff60f19dec8 memcpy_s 11 API calls 15428->15433 15428->15446 15430->15425 15430->15446 15592 7ff60f1a63fc 15430->15592 15435 7ff60f19fef5 15431->15435 15438 7ff60f19ff25 15433->15438 15434 7ff60f199f88 __free_lconv_mon 11 API calls 15434->15414 15442 7ff60f199f88 __free_lconv_mon 11 API calls 15435->15442 15436 7ff60f19feb7 15436->15430 15445 7ff60f1a023c 45 API calls 15436->15445 15437 7ff60f19fe99 15443 7ff60f196098 memcpy_s 11 API calls 15437->15443 15440 7ff60f199f88 __free_lconv_mon 11 API calls 15438->15440 15441 7ff60f199f88 __free_lconv_mon 11 API calls 15439->15441 15440->15430 15444 7ff60f19ffb4 15441->15444 15442->15428 15443->15446 15451 7ff60f1a258c 40 API calls 15444->15451 15454 7ff60f19ffba 15444->15454 15445->15430 15446->15434 15447->15446 15448 7ff60f1a258c 40 API calls 15447->15448 15449 7ff60f1a003c 15448->15449 15450 7ff60f199f88 __free_lconv_mon 11 API calls 15449->15450 15452 7ff60f1a0046 15450->15452 15455 7ff60f19ffe6 15451->15455 15452->15446 15452->15454 15453 7ff60f1a00ff 15457 7ff60f199f88 __free_lconv_mon 11 API calls 15453->15457 15454->15453 15458 7ff60f19dec8 memcpy_s 11 API calls 15454->15458 15456 7ff60f199f88 __free_lconv_mon 11 API calls 15455->15456 15456->15454 15457->15414 15459 7ff60f1a008b 15458->15459 15460 7ff60f1a0093 15459->15460 15461 7ff60f1a009c 15459->15461 15463 7ff60f199f88 __free_lconv_mon 11 API calls 15460->15463 15462 7ff60f19f9b4 _wfindfirst32i64 37 API calls 15461->15462 15464 7ff60f1a00aa 15462->15464 15476 7ff60f1a009a 15463->15476 15465 7ff60f1a013f 15464->15465 15466 7ff60f1a00b2 SetEnvironmentVariableW 15464->15466 15469 7ff60f199f40 _wfindfirst32i64 17 API calls 15465->15469 15467 7ff60f1a00f7 15466->15467 15468 7ff60f1a00d6 15466->15468 15473 7ff60f199f88 __free_lconv_mon 11 API calls 15467->15473 15471 7ff60f196098 memcpy_s 11 API calls 15468->15471 15472 7ff60f1a0153 15469->15472 15470 7ff60f199f88 __free_lconv_mon 11 API calls 15470->15414 15474 7ff60f1a00db 15471->15474 15473->15453 15475 7ff60f199f88 __free_lconv_mon 11 API calls 15474->15475 15475->15476 15476->15470 15478 7ff60f199333 15477->15478 15479 7ff60f199329 15477->15479 15480 7ff60f196098 memcpy_s 11 API calls 15478->15480 15479->15478 15484 7ff60f19934e 15479->15484 15481 7ff60f19933a 15480->15481 15482 7ff60f199f20 _invalid_parameter_noinfo 37 API calls 15481->15482 15483 7ff60f199346 15482->15483 15483->15400 15483->15401 15484->15483 15485 7ff60f196098 memcpy_s 11 API calls 15484->15485 15485->15481 15487 7ff60f1a025f 15486->15487 15488 7ff60f1a027c 15486->15488 15487->15420 15489 7ff60f19dec8 memcpy_s 11 API calls 15488->15489 15496 7ff60f1a02a0 15489->15496 15490 7ff60f19937c __CxxCallCatchBlock 45 API calls 15492 7ff60f1a032a 15490->15492 15491 7ff60f1a0301 15493 7ff60f199f88 __free_lconv_mon 11 API calls 15491->15493 15493->15487 15494 7ff60f19dec8 memcpy_s 11 API calls 15494->15496 15495 7ff60f199f88 __free_lconv_mon 11 API calls 15495->15496 15496->15491 15496->15494 15496->15495 15497 7ff60f19f9b4 _wfindfirst32i64 37 API calls 15496->15497 15498 7ff60f1a0310 15496->15498 15500 7ff60f1a0324 15496->15500 15497->15496 15499 7ff60f199f40 _wfindfirst32i64 17 API calls 15498->15499 15499->15500 15500->15490 15502 7ff60f1a0189 15501->15502 15509 7ff60f1a0171 15501->15509 15503 7ff60f19dec8 memcpy_s 11 API calls 15502->15503 15504 7ff60f1a01ad 15503->15504 15505 7ff60f1a020e 15504->15505 15510 7ff60f19dec8 memcpy_s 11 API calls 15504->15510 15511 7ff60f199f88 __free_lconv_mon 11 API calls 15504->15511 15512 7ff60f19931c __std_exception_copy 37 API calls 15504->15512 15513 7ff60f1a021d 15504->15513 15515 7ff60f1a0232 15504->15515 15507 7ff60f199f88 __free_lconv_mon 11 API calls 15505->15507 15506 7ff60f19937c __CxxCallCatchBlock 45 API calls 15508 7ff60f1a0238 15506->15508 15507->15509 15509->15354 15510->15504 15511->15504 15512->15504 15514 7ff60f199f40 _wfindfirst32i64 17 API calls 15513->15514 15514->15515 15515->15506 15517 7ff60f1986a5 15516->15517 15518 7ff60f19869c 15516->15518 15517->15368 15517->15369 15518->15517 15616 7ff60f198164 15518->15616 15523 7ff60f1a6549 15522->15523 15524 7ff60f1a56ec 15522->15524 15526 7ff60f194a94 45 API calls 15523->15526 15525 7ff60f1a56f9 15524->15525 15533 7ff60f1a572f 15524->15533 15529 7ff60f196098 memcpy_s 11 API calls 15525->15529 15543 7ff60f1a56a0 15525->15543 15527 7ff60f1a657d 15526->15527 15530 7ff60f1a6582 15527->15530 15534 7ff60f1a6593 15527->15534 15538 7ff60f1a65aa 15527->15538 15528 7ff60f1a5759 15531 7ff60f196098 memcpy_s 11 API calls 15528->15531 15532 7ff60f1a5703 15529->15532 15530->15363 15535 7ff60f1a575e 15531->15535 15536 7ff60f199f20 _invalid_parameter_noinfo 37 API calls 15532->15536 15533->15528 15537 7ff60f1a577e 15533->15537 15539 7ff60f196098 memcpy_s 11 API calls 15534->15539 15540 7ff60f199f20 _invalid_parameter_noinfo 37 API calls 15535->15540 15541 7ff60f1a570e 15536->15541 15542 7ff60f194a94 45 API calls 15537->15542 15547 7ff60f1a5769 15537->15547 15545 7ff60f1a65b4 15538->15545 15546 7ff60f1a65c6 15538->15546 15544 7ff60f1a6598 15539->15544 15540->15547 15541->15363 15542->15547 15543->15363 15550 7ff60f199f20 _invalid_parameter_noinfo 37 API calls 15544->15550 15551 7ff60f196098 memcpy_s 11 API calls 15545->15551 15548 7ff60f1a65ee 15546->15548 15549 7ff60f1a65d7 15546->15549 15547->15363 15911 7ff60f1a8418 15548->15911 15902 7ff60f1a573c 15549->15902 15550->15530 15552 7ff60f1a65b9 15551->15552 15555 7ff60f199f20 _invalid_parameter_noinfo 37 API calls 15552->15555 15555->15530 15557 7ff60f196098 memcpy_s 11 API calls 15557->15530 15559 7ff60f1a25ae 15558->15559 15560 7ff60f1a25cb 15558->15560 15559->15560 15561 7ff60f1a25bc 15559->15561 15562 7ff60f1a25d5 15560->15562 15951 7ff60f1a7048 15560->15951 15563 7ff60f196098 memcpy_s 11 API calls 15561->15563 15958 7ff60f19fa1c 15562->15958 15566 7ff60f1a25c1 memcpy_s 15563->15566 15566->15388 15568 7ff60f194a94 45 API calls 15567->15568 15569 7ff60f1a66ba 15568->15569 15570 7ff60f1a66c8 15569->15570 15970 7ff60f19e154 15569->15970 15973 7ff60f19457c 15570->15973 15574 7ff60f1a67b4 15576 7ff60f1a67c5 15574->15576 15578 7ff60f199f88 __free_lconv_mon 11 API calls 15574->15578 15575 7ff60f194a94 45 API calls 15577 7ff60f1a6737 15575->15577 15579 7ff60f19fd73 15576->15579 15581 7ff60f199f88 __free_lconv_mon 11 API calls 15576->15581 15580 7ff60f19e154 5 API calls 15577->15580 15582 7ff60f1a6740 15577->15582 15578->15576 15579->15407 15579->15408 15580->15582 15581->15579 15583 7ff60f19457c 14 API calls 15582->15583 15584 7ff60f1a679b 15583->15584 15584->15574 15585 7ff60f1a67a3 SetEnvironmentVariableW 15584->15585 15585->15574 15587 7ff60f1986e1 15586->15587 15588 7ff60f1986d8 15586->15588 15587->15436 15587->15437 15588->15587 16000 7ff60f1981d8 15588->16000 15593 7ff60f1a6409 15592->15593 15597 7ff60f1a6436 15592->15597 15594 7ff60f1a640e 15593->15594 15593->15597 15596 7ff60f196098 memcpy_s 11 API calls 15594->15596 15595 7ff60f1a646e __crtLCMapStringW 15595->15430 15599 7ff60f1a6413 15596->15599 15597->15595 15598 7ff60f1a647a 15597->15598 15601 7ff60f1a6499 15597->15601 15600 7ff60f196098 memcpy_s 11 API calls 15598->15600 15602 7ff60f199f20 _invalid_parameter_noinfo 37 API calls 15599->15602 15603 7ff60f1a647f 15600->15603 15604 7ff60f1a64a3 15601->15604 15605 7ff60f1a64b5 15601->15605 15606 7ff60f1a641e 15602->15606 15609 7ff60f199f20 _invalid_parameter_noinfo 37 API calls 15603->15609 15607 7ff60f196098 memcpy_s 11 API calls 15604->15607 15608 7ff60f194a94 45 API calls 15605->15608 15606->15430 15610 7ff60f1a64a8 15607->15610 15611 7ff60f1a64c2 15608->15611 15609->15595 15612 7ff60f199f20 _invalid_parameter_noinfo 37 API calls 15610->15612 15611->15595 16047 7ff60f1a7fd4 15611->16047 15612->15595 15615 7ff60f196098 memcpy_s 11 API calls 15615->15595 15617 7ff60f198179 15616->15617 15618 7ff60f19817d 15616->15618 15617->15517 15631 7ff60f1984b8 15617->15631 15639 7ff60f1a17c0 15618->15639 15623 7ff60f19818f 15626 7ff60f199f88 __free_lconv_mon 11 API calls 15623->15626 15624 7ff60f19819b 15665 7ff60f198248 15624->15665 15626->15617 15628 7ff60f199f88 __free_lconv_mon 11 API calls 15629 7ff60f1981c2 15628->15629 15630 7ff60f199f88 __free_lconv_mon 11 API calls 15629->15630 15630->15617 15636 7ff60f1984e1 15631->15636 15637 7ff60f1984fa 15631->15637 15632 7ff60f19f148 WideCharToMultiByte 15632->15637 15633 7ff60f19dec8 memcpy_s 11 API calls 15633->15637 15634 7ff60f19858a 15635 7ff60f199f88 __free_lconv_mon 11 API calls 15634->15635 15635->15636 15636->15517 15637->15632 15637->15633 15637->15634 15637->15636 15638 7ff60f199f88 __free_lconv_mon 11 API calls 15637->15638 15638->15637 15640 7ff60f198182 15639->15640 15641 7ff60f1a17cd 15639->15641 15645 7ff60f1a1afc GetEnvironmentStringsW 15640->15645 15684 7ff60f19a864 15641->15684 15646 7ff60f1a1b2c 15645->15646 15647 7ff60f198187 15645->15647 15648 7ff60f19f148 WideCharToMultiByte 15646->15648 15647->15623 15647->15624 15649 7ff60f1a1b7d 15648->15649 15650 7ff60f1a1b84 FreeEnvironmentStringsW 15649->15650 15651 7ff60f19cc3c _fread_nolock 12 API calls 15649->15651 15650->15647 15652 7ff60f1a1b97 15651->15652 15653 7ff60f1a1b9f 15652->15653 15654 7ff60f1a1ba8 15652->15654 15655 7ff60f199f88 __free_lconv_mon 11 API calls 15653->15655 15656 7ff60f19f148 WideCharToMultiByte 15654->15656 15657 7ff60f1a1ba6 15655->15657 15658 7ff60f1a1bcb 15656->15658 15657->15650 15659 7ff60f1a1bcf 15658->15659 15660 7ff60f1a1bd9 15658->15660 15661 7ff60f199f88 __free_lconv_mon 11 API calls 15659->15661 15662 7ff60f199f88 __free_lconv_mon 11 API calls 15660->15662 15663 7ff60f1a1bd7 FreeEnvironmentStringsW 15661->15663 15662->15663 15663->15647 15666 7ff60f19826d 15665->15666 15667 7ff60f19dec8 memcpy_s 11 API calls 15666->15667 15679 7ff60f1982a3 15667->15679 15668 7ff60f1982ab 15669 7ff60f199f88 __free_lconv_mon 11 API calls 15668->15669 15671 7ff60f1981a3 15669->15671 15670 7ff60f19831e 15672 7ff60f199f88 __free_lconv_mon 11 API calls 15670->15672 15671->15628 15672->15671 15673 7ff60f19dec8 memcpy_s 11 API calls 15673->15679 15674 7ff60f19830d 15896 7ff60f198474 15674->15896 15675 7ff60f19931c __std_exception_copy 37 API calls 15675->15679 15678 7ff60f198343 15681 7ff60f199f40 _wfindfirst32i64 17 API calls 15678->15681 15679->15668 15679->15670 15679->15673 15679->15674 15679->15675 15679->15678 15682 7ff60f199f88 __free_lconv_mon 11 API calls 15679->15682 15680 7ff60f199f88 __free_lconv_mon 11 API calls 15680->15668 15683 7ff60f198356 15681->15683 15682->15679 15685 7ff60f19a890 FlsSetValue 15684->15685 15686 7ff60f19a875 FlsGetValue 15684->15686 15687 7ff60f19a882 15685->15687 15689 7ff60f19a89d 15685->15689 15686->15687 15688 7ff60f19a88a 15686->15688 15690 7ff60f19937c __CxxCallCatchBlock 45 API calls 15687->15690 15693 7ff60f19a888 15687->15693 15688->15685 15691 7ff60f19dec8 memcpy_s 11 API calls 15689->15691 15694 7ff60f19a905 15690->15694 15692 7ff60f19a8ac 15691->15692 15695 7ff60f19a8ca FlsSetValue 15692->15695 15696 7ff60f19a8ba FlsSetValue 15692->15696 15704 7ff60f1a1494 15693->15704 15698 7ff60f19a8d6 FlsSetValue 15695->15698 15699 7ff60f19a8e8 15695->15699 15697 7ff60f19a8c3 15696->15697 15700 7ff60f199f88 __free_lconv_mon 11 API calls 15697->15700 15698->15697 15701 7ff60f19a534 memcpy_s 11 API calls 15699->15701 15700->15687 15702 7ff60f19a8f0 15701->15702 15703 7ff60f199f88 __free_lconv_mon 11 API calls 15702->15703 15703->15693 15727 7ff60f1a1704 15704->15727 15706 7ff60f1a14c9 15742 7ff60f1a1194 15706->15742 15709 7ff60f19cc3c _fread_nolock 12 API calls 15710 7ff60f1a14f7 15709->15710 15711 7ff60f1a14ff 15710->15711 15713 7ff60f1a150e 15710->15713 15712 7ff60f199f88 __free_lconv_mon 11 API calls 15711->15712 15724 7ff60f1a14e6 15712->15724 15713->15713 15749 7ff60f1a183c 15713->15749 15716 7ff60f1a160a 15717 7ff60f196098 memcpy_s 11 API calls 15716->15717 15718 7ff60f1a160f 15717->15718 15720 7ff60f199f88 __free_lconv_mon 11 API calls 15718->15720 15719 7ff60f1a1665 15722 7ff60f1a16cc 15719->15722 15760 7ff60f1a0fc4 15719->15760 15720->15724 15721 7ff60f1a1624 15721->15719 15725 7ff60f199f88 __free_lconv_mon 11 API calls 15721->15725 15723 7ff60f199f88 __free_lconv_mon 11 API calls 15722->15723 15723->15724 15724->15640 15725->15719 15728 7ff60f1a1727 15727->15728 15729 7ff60f1a1731 15728->15729 15775 7ff60f19f818 EnterCriticalSection 15728->15775 15732 7ff60f1a17a3 15729->15732 15735 7ff60f19937c __CxxCallCatchBlock 45 API calls 15729->15735 15732->15706 15736 7ff60f1a17bb 15735->15736 15737 7ff60f1a1812 15736->15737 15739 7ff60f19a864 50 API calls 15736->15739 15737->15706 15740 7ff60f1a17fc 15739->15740 15741 7ff60f1a1494 65 API calls 15740->15741 15741->15737 15776 7ff60f194a94 15742->15776 15745 7ff60f1a11b4 GetOEMCP 15748 7ff60f1a11db 15745->15748 15746 7ff60f1a11c6 15747 7ff60f1a11cb GetACP 15746->15747 15746->15748 15747->15748 15748->15709 15748->15724 15750 7ff60f1a1194 47 API calls 15749->15750 15751 7ff60f1a1869 15750->15751 15753 7ff60f1a18a6 IsValidCodePage 15751->15753 15758 7ff60f1a19bf 15751->15758 15759 7ff60f1a18c0 memcpy_s 15751->15759 15752 7ff60f18a110 _wfindfirst32i64 8 API calls 15754 7ff60f1a1601 15752->15754 15755 7ff60f1a18b7 15753->15755 15753->15758 15754->15716 15754->15721 15756 7ff60f1a18e6 GetCPInfo 15755->15756 15755->15759 15756->15758 15756->15759 15758->15752 15808 7ff60f1a12ac 15759->15808 15895 7ff60f19f818 EnterCriticalSection 15760->15895 15777 7ff60f194ab3 15776->15777 15778 7ff60f194ab8 15776->15778 15777->15745 15777->15746 15778->15777 15779 7ff60f19a790 __CxxCallCatchBlock 45 API calls 15778->15779 15780 7ff60f194ad3 15779->15780 15784 7ff60f19cc9c 15780->15784 15785 7ff60f19ccb1 15784->15785 15787 7ff60f194af6 15784->15787 15785->15787 15792 7ff60f1a24b4 15785->15792 15788 7ff60f19cd08 15787->15788 15789 7ff60f19cd30 15788->15789 15790 7ff60f19cd1d 15788->15790 15789->15777 15790->15789 15805 7ff60f1a1820 15790->15805 15793 7ff60f19a790 __CxxCallCatchBlock 45 API calls 15792->15793 15794 7ff60f1a24c3 15793->15794 15795 7ff60f1a250e 15794->15795 15804 7ff60f19f818 EnterCriticalSection 15794->15804 15795->15787 15806 7ff60f19a790 __CxxCallCatchBlock 45 API calls 15805->15806 15807 7ff60f1a1829 15806->15807 15809 7ff60f1a12e9 GetCPInfo 15808->15809 15818 7ff60f1a13df 15808->15818 15814 7ff60f1a12fc 15809->15814 15809->15818 15810 7ff60f18a110 _wfindfirst32i64 8 API calls 15812 7ff60f1a147e 15810->15812 15812->15758 15819 7ff60f1a1ff0 15814->15819 15818->15810 15820 7ff60f194a94 45 API calls 15819->15820 15821 7ff60f1a2032 15820->15821 15839 7ff60f19e880 15821->15839 15841 7ff60f19e889 MultiByteToWideChar 15839->15841 15900 7ff60f198315 15896->15900 15901 7ff60f198479 15896->15901 15897 7ff60f1984a2 15898 7ff60f199f88 __free_lconv_mon 11 API calls 15897->15898 15898->15900 15899 7ff60f199f88 __free_lconv_mon 11 API calls 15899->15901 15900->15680 15901->15897 15901->15899 15903 7ff60f1a5770 15902->15903 15904 7ff60f1a5759 15902->15904 15903->15904 15907 7ff60f1a577e 15903->15907 15905 7ff60f196098 memcpy_s 11 API calls 15904->15905 15906 7ff60f1a575e 15905->15906 15908 7ff60f199f20 _invalid_parameter_noinfo 37 API calls 15906->15908 15909 7ff60f194a94 45 API calls 15907->15909 15910 7ff60f1a5769 15907->15910 15908->15910 15909->15910 15910->15530 15912 7ff60f194a94 45 API calls 15911->15912 15913 7ff60f1a843d 15912->15913 15916 7ff60f1a8094 15913->15916 15918 7ff60f1a80e2 15916->15918 15917 7ff60f18a110 _wfindfirst32i64 8 API calls 15919 7ff60f1a6615 15917->15919 15920 7ff60f1a8169 15918->15920 15922 7ff60f1a8154 GetCPInfo 15918->15922 15925 7ff60f1a816d 15918->15925 15919->15530 15919->15557 15921 7ff60f19e880 _fread_nolock MultiByteToWideChar 15920->15921 15920->15925 15923 7ff60f1a8201 15921->15923 15922->15920 15922->15925 15924 7ff60f19cc3c _fread_nolock 12 API calls 15923->15924 15923->15925 15926 7ff60f1a8238 15923->15926 15924->15926 15925->15917 15926->15925 15927 7ff60f19e880 _fread_nolock MultiByteToWideChar 15926->15927 15928 7ff60f1a82a6 15927->15928 15929 7ff60f19e880 _fread_nolock MultiByteToWideChar 15928->15929 15930 7ff60f1a8388 15928->15930 15932 7ff60f1a82cc 15929->15932 15930->15925 15931 7ff60f199f88 __free_lconv_mon 11 API calls 15930->15931 15931->15925 15932->15930 15933 7ff60f19cc3c _fread_nolock 12 API calls 15932->15933 15934 7ff60f1a82f9 15932->15934 15933->15934 15934->15930 15935 7ff60f19e880 _fread_nolock MultiByteToWideChar 15934->15935 15936 7ff60f1a8370 15935->15936 15937 7ff60f1a8390 15936->15937 15938 7ff60f1a8376 15936->15938 15945 7ff60f19e198 15937->15945 15938->15930 15941 7ff60f199f88 __free_lconv_mon 11 API calls 15938->15941 15941->15930 15942 7ff60f1a83cf 15942->15925 15944 7ff60f199f88 __free_lconv_mon 11 API calls 15942->15944 15943 7ff60f199f88 __free_lconv_mon 11 API calls 15943->15942 15944->15925 15946 7ff60f19df40 __crtLCMapStringW 5 API calls 15945->15946 15947 7ff60f19e1d6 15946->15947 15948 7ff60f19e400 __crtLCMapStringW 5 API calls 15947->15948 15949 7ff60f19e1de 15947->15949 15950 7ff60f19e247 CompareStringW 15948->15950 15949->15942 15949->15943 15950->15949 15952 7ff60f1a7051 15951->15952 15953 7ff60f1a706a HeapSize 15951->15953 15954 7ff60f196098 memcpy_s 11 API calls 15952->15954 15955 7ff60f1a7056 15954->15955 15956 7ff60f199f20 _invalid_parameter_noinfo 37 API calls 15955->15956 15957 7ff60f1a7061 15956->15957 15957->15562 15959 7ff60f19fa31 15958->15959 15960 7ff60f19fa3b 15958->15960 15962 7ff60f19cc3c _fread_nolock 12 API calls 15959->15962 15961 7ff60f19fa40 15960->15961 15968 7ff60f19fa47 memcpy_s 15960->15968 15963 7ff60f199f88 __free_lconv_mon 11 API calls 15961->15963 15966 7ff60f19fa39 15962->15966 15963->15966 15964 7ff60f19fa7a HeapReAlloc 15964->15966 15964->15968 15965 7ff60f19fa4d 15967 7ff60f196098 memcpy_s 11 API calls 15965->15967 15966->15566 15967->15966 15968->15964 15968->15965 15969 7ff60f1a2740 memcpy_s 2 API calls 15968->15969 15969->15968 15971 7ff60f19df40 __crtLCMapStringW 5 API calls 15970->15971 15972 7ff60f19e174 15971->15972 15972->15570 15974 7ff60f1945a6 15973->15974 15975 7ff60f1945ca 15973->15975 15979 7ff60f199f88 __free_lconv_mon 11 API calls 15974->15979 15980 7ff60f1945b5 15974->15980 15976 7ff60f1945cf 15975->15976 15977 7ff60f194624 15975->15977 15976->15980 15981 7ff60f1945e4 15976->15981 15982 7ff60f199f88 __free_lconv_mon 11 API calls 15976->15982 15978 7ff60f19e880 _fread_nolock MultiByteToWideChar 15977->15978 15986 7ff60f194640 15978->15986 15979->15980 15980->15574 15980->15575 15983 7ff60f19cc3c _fread_nolock 12 API calls 15981->15983 15982->15981 15983->15980 15984 7ff60f194647 GetLastError 15995 7ff60f19600c 15984->15995 15986->15984 15989 7ff60f199f88 __free_lconv_mon 11 API calls 15986->15989 15993 7ff60f194675 15986->15993 15994 7ff60f194682 15986->15994 15987 7ff60f19e880 _fread_nolock MultiByteToWideChar 15991 7ff60f1946c6 15987->15991 15989->15993 15990 7ff60f19cc3c _fread_nolock 12 API calls 15990->15994 15991->15980 15991->15984 15992 7ff60f196098 memcpy_s 11 API calls 15992->15980 15993->15990 15994->15980 15994->15987 15996 7ff60f19a908 memcpy_s 11 API calls 15995->15996 15997 7ff60f196019 __free_lconv_mon 15996->15997 15998 7ff60f19a908 memcpy_s 11 API calls 15997->15998 15999 7ff60f194654 15998->15999 15999->15992 16001 7ff60f1981f1 16000->16001 16012 7ff60f1981ed 16000->16012 16021 7ff60f1a1c0c GetEnvironmentStringsW 16001->16021 16004 7ff60f1981fe 16006 7ff60f199f88 __free_lconv_mon 11 API calls 16004->16006 16005 7ff60f19820a 16028 7ff60f198358 16005->16028 16006->16012 16009 7ff60f199f88 __free_lconv_mon 11 API calls 16010 7ff60f198231 16009->16010 16011 7ff60f199f88 __free_lconv_mon 11 API calls 16010->16011 16011->16012 16012->15587 16013 7ff60f198598 16012->16013 16014 7ff60f1985bb 16013->16014 16019 7ff60f1985d2 16013->16019 16014->15587 16015 7ff60f19e880 MultiByteToWideChar _fread_nolock 16015->16019 16016 7ff60f19dec8 memcpy_s 11 API calls 16016->16019 16017 7ff60f198646 16018 7ff60f199f88 __free_lconv_mon 11 API calls 16017->16018 16018->16014 16019->16014 16019->16015 16019->16016 16019->16017 16020 7ff60f199f88 __free_lconv_mon 11 API calls 16019->16020 16020->16019 16022 7ff60f1a1c30 16021->16022 16023 7ff60f1981f6 16021->16023 16024 7ff60f19cc3c _fread_nolock 12 API calls 16022->16024 16023->16004 16023->16005 16025 7ff60f1a1c67 memcpy_s 16024->16025 16026 7ff60f199f88 __free_lconv_mon 11 API calls 16025->16026 16027 7ff60f1a1c87 FreeEnvironmentStringsW 16026->16027 16027->16023 16029 7ff60f198380 16028->16029 16030 7ff60f19dec8 memcpy_s 11 API calls 16029->16030 16041 7ff60f1983bb 16030->16041 16031 7ff60f199f88 __free_lconv_mon 11 API calls 16032 7ff60f198212 16031->16032 16032->16009 16033 7ff60f19843d 16034 7ff60f199f88 __free_lconv_mon 11 API calls 16033->16034 16034->16032 16035 7ff60f19dec8 memcpy_s 11 API calls 16035->16041 16036 7ff60f19842c 16038 7ff60f198474 11 API calls 16036->16038 16037 7ff60f19f9b4 _wfindfirst32i64 37 API calls 16037->16041 16039 7ff60f198434 16038->16039 16042 7ff60f199f88 __free_lconv_mon 11 API calls 16039->16042 16040 7ff60f198460 16043 7ff60f199f40 _wfindfirst32i64 17 API calls 16040->16043 16041->16033 16041->16035 16041->16036 16041->16037 16041->16040 16044 7ff60f199f88 __free_lconv_mon 11 API calls 16041->16044 16045 7ff60f1983c3 16041->16045 16042->16045 16046 7ff60f198472 16043->16046 16044->16041 16045->16031 16049 7ff60f1a7ffd __crtLCMapStringW 16047->16049 16048 7ff60f1a64fe 16048->15595 16048->15615 16049->16048 16050 7ff60f19e198 6 API calls 16049->16050 16050->16048 19354 7ff60f1a0630 19372 7ff60f19f818 EnterCriticalSection 19354->19372 15263 7ff60f198929 15275 7ff60f199248 15263->15275 15280 7ff60f19a790 GetLastError 15275->15280 15281 7ff60f19a7d1 FlsSetValue 15280->15281 15282 7ff60f19a7b4 FlsGetValue 15280->15282 15284 7ff60f19a7e3 15281->15284 15300 7ff60f19a7c1 15281->15300 15283 7ff60f19a7cb 15282->15283 15282->15300 15283->15281 15286 7ff60f19dec8 memcpy_s 11 API calls 15284->15286 15285 7ff60f19a83d SetLastError 15287 7ff60f199251 15285->15287 15288 7ff60f19a85d 15285->15288 15289 7ff60f19a7f2 15286->15289 15302 7ff60f19937c 15287->15302 15290 7ff60f19937c __CxxCallCatchBlock 38 API calls 15288->15290 15291 7ff60f19a810 FlsSetValue 15289->15291 15292 7ff60f19a800 FlsSetValue 15289->15292 15293 7ff60f19a862 15290->15293 15295 7ff60f19a82e 15291->15295 15296 7ff60f19a81c FlsSetValue 15291->15296 15294 7ff60f19a809 15292->15294 15298 7ff60f199f88 __free_lconv_mon 11 API calls 15294->15298 15297 7ff60f19a534 memcpy_s 11 API calls 15295->15297 15296->15294 15299 7ff60f19a836 15297->15299 15298->15300 15301 7ff60f199f88 __free_lconv_mon 11 API calls 15299->15301 15300->15285 15301->15285 15311 7ff60f1a2800 15302->15311 15337 7ff60f1a27b8 15311->15337 15342 7ff60f19f818 EnterCriticalSection 15337->15342 16051 7ff60f18a52c 16072 7ff60f18a70c 16051->16072 16054 7ff60f18a683 16177 7ff60f18aa3c IsProcessorFeaturePresent 16054->16177 16055 7ff60f18a54d __scrt_acquire_startup_lock 16057 7ff60f18a68d 16055->16057 16063 7ff60f18a56b __scrt_release_startup_lock 16055->16063 16058 7ff60f18aa3c 7 API calls 16057->16058 16059 7ff60f18a698 __CxxCallCatchBlock 16058->16059 16060 7ff60f18a590 16061 7ff60f18a616 16080 7ff60f198748 16061->16080 16063->16060 16063->16061 16166 7ff60f198af4 16063->16166 16065 7ff60f18a61b 16086 7ff60f181000 16065->16086 16069 7ff60f18a63f 16069->16059 16173 7ff60f18a8a0 16069->16173 16184 7ff60f18acdc 16072->16184 16075 7ff60f18a545 16075->16054 16075->16055 16076 7ff60f18a73b 16186 7ff60f1991fc 16076->16186 16081 7ff60f198758 16080->16081 16082 7ff60f19876d 16080->16082 16081->16082 16083 7ff60f1981d8 40 API calls 16081->16083 16082->16065 16084 7ff60f198776 16083->16084 16084->16082 16085 7ff60f198598 12 API calls 16084->16085 16085->16082 16087 7ff60f181011 16086->16087 16229 7ff60f1867d0 16087->16229 16089 7ff60f181023 16236 7ff60f194f8c 16089->16236 16091 7ff60f1827ab 16243 7ff60f181af0 16091->16243 16095 7ff60f18a110 _wfindfirst32i64 8 API calls 16096 7ff60f1828de 16095->16096 16171 7ff60f18ab90 GetModuleHandleW 16096->16171 16097 7ff60f1827c9 16158 7ff60f1828ca 16097->16158 16259 7ff60f182c50 16097->16259 16099 7ff60f1827fb 16099->16158 16262 7ff60f185af0 16099->16262 16101 7ff60f182817 16102 7ff60f182863 16101->16102 16103 7ff60f185af0 92 API calls 16101->16103 16277 7ff60f186100 16102->16277 16109 7ff60f182838 __vcrt_freefls 16103->16109 16105 7ff60f182878 16281 7ff60f1819d0 16105->16281 16108 7ff60f18296d 16111 7ff60f182998 16108->16111 16399 7ff60f1824a0 16108->16399 16109->16102 16113 7ff60f186100 89 API calls 16109->16113 16110 7ff60f1819d0 121 API calls 16112 7ff60f1828ae 16110->16112 16122 7ff60f1829db 16111->16122 16292 7ff60f186dc0 16111->16292 16116 7ff60f1828b2 16112->16116 16117 7ff60f1828f0 16112->16117 16113->16102 16370 7ff60f181c50 16116->16370 16117->16108 16376 7ff60f182de0 16117->16376 16118 7ff60f1829b8 16119 7ff60f1829bd 16118->16119 16120 7ff60f1829ce SetDllDirectoryW 16118->16120 16123 7ff60f181c50 86 API calls 16119->16123 16120->16122 16306 7ff60f184fa0 16122->16306 16123->16158 16128 7ff60f182912 16132 7ff60f181c50 86 API calls 16128->16132 16131 7ff60f182940 16131->16108 16134 7ff60f182945 16131->16134 16132->16158 16133 7ff60f1829f8 16155 7ff60f182a2a 16133->16155 16413 7ff60f1847a0 16133->16413 16395 7ff60f18e61c 16134->16395 16135 7ff60f182af6 16310 7ff60f182330 16135->16310 16141 7ff60f182a49 16148 7ff60f182a95 16141->16148 16449 7ff60f181b30 16141->16449 16142 7ff60f182a2c 16144 7ff60f1849f0 FreeLibrary 16142->16144 16144->16155 16147 7ff60f182b2b 16151 7ff60f185af0 92 API calls 16147->16151 16148->16158 16453 7ff60f1822d0 16148->16453 16150 7ff60f182a1b 16443 7ff60f184df0 16150->16443 16156 7ff60f182b37 16151->16156 16154 7ff60f182ad1 16157 7ff60f1849f0 FreeLibrary 16154->16157 16155->16135 16155->16141 16156->16158 16327 7ff60f186140 16156->16327 16157->16158 16158->16095 16167 7ff60f198b0b 16166->16167 16168 7ff60f198b2c 16166->16168 16167->16061 16169 7ff60f199248 45 API calls 16168->16169 16170 7ff60f198b31 16169->16170 16172 7ff60f18aba1 16171->16172 16172->16069 16175 7ff60f18a8b1 16173->16175 16174 7ff60f18a656 16174->16060 16175->16174 16176 7ff60f18be38 __scrt_initialize_crt 7 API calls 16175->16176 16176->16174 16178 7ff60f18aa62 _wfindfirst32i64 memcpy_s 16177->16178 16179 7ff60f18aa81 RtlCaptureContext RtlLookupFunctionEntry 16178->16179 16180 7ff60f18aae6 memcpy_s 16179->16180 16181 7ff60f18aaaa RtlVirtualUnwind 16179->16181 16182 7ff60f18ab18 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 16180->16182 16181->16180 16183 7ff60f18ab6a _wfindfirst32i64 16182->16183 16183->16057 16185 7ff60f18a72e __scrt_dllmain_crt_thread_attach 16184->16185 16185->16075 16185->16076 16187 7ff60f1a265c 16186->16187 16188 7ff60f18a740 16187->16188 16196 7ff60f19bb60 16187->16196 16188->16075 16190 7ff60f18be38 16188->16190 16191 7ff60f18be40 16190->16191 16192 7ff60f18be4a 16190->16192 16208 7ff60f18c1b4 16191->16208 16192->16075 16207 7ff60f19f818 EnterCriticalSection 16196->16207 16209 7ff60f18c1c3 16208->16209 16211 7ff60f18be45 16208->16211 16216 7ff60f18c3f0 16209->16216 16212 7ff60f18c220 16211->16212 16213 7ff60f18c24b 16212->16213 16214 7ff60f18c22e DeleteCriticalSection 16213->16214 16215 7ff60f18c24f 16213->16215 16214->16213 16215->16192 16220 7ff60f18c258 16216->16220 16221 7ff60f18c29c __vcrt_InitializeCriticalSectionEx 16220->16221 16227 7ff60f18c372 TlsFree 16220->16227 16222 7ff60f18c2ca LoadLibraryExW 16221->16222 16223 7ff60f18c361 GetProcAddress 16221->16223 16221->16227 16228 7ff60f18c30d LoadLibraryExW 16221->16228 16224 7ff60f18c341 16222->16224 16225 7ff60f18c2eb GetLastError 16222->16225 16223->16227 16224->16223 16226 7ff60f18c358 FreeLibrary 16224->16226 16225->16221 16226->16223 16228->16221 16228->16224 16231 7ff60f1867ef 16229->16231 16230 7ff60f186840 WideCharToMultiByte 16230->16231 16233 7ff60f1868e8 16230->16233 16231->16230 16232 7ff60f186896 WideCharToMultiByte 16231->16232 16231->16233 16235 7ff60f1867f7 __vcrt_freefls 16231->16235 16232->16231 16232->16233 16485 7ff60f181cb0 16233->16485 16235->16089 16238 7ff60f19ecd0 16236->16238 16237 7ff60f19ed23 16239 7ff60f199e54 _invalid_parameter_noinfo 37 API calls 16237->16239 16238->16237 16240 7ff60f19ed76 16238->16240 16242 7ff60f19ed4c 16239->16242 16785 7ff60f19eba8 16240->16785 16242->16091 16244 7ff60f181b05 16243->16244 16245 7ff60f181b20 16244->16245 16793 7ff60f181c10 16244->16793 16245->16158 16247 7ff60f182cd0 16245->16247 16816 7ff60f18a140 16247->16816 16250 7ff60f182d0b 16252 7ff60f181cb0 86 API calls 16250->16252 16251 7ff60f182d22 16818 7ff60f186ed0 16251->16818 16254 7ff60f182d1e 16252->16254 16256 7ff60f18a110 _wfindfirst32i64 8 API calls 16254->16256 16258 7ff60f182d5f 16256->16258 16257 7ff60f181c50 86 API calls 16257->16254 16258->16097 16260 7ff60f181b30 49 API calls 16259->16260 16261 7ff60f182c6d 16260->16261 16261->16099 16263 7ff60f185afa 16262->16263 16264 7ff60f186dc0 88 API calls 16263->16264 16265 7ff60f185b1c GetEnvironmentVariableW 16264->16265 16266 7ff60f185b86 16265->16266 16267 7ff60f185b34 ExpandEnvironmentStringsW 16265->16267 16268 7ff60f18a110 _wfindfirst32i64 8 API calls 16266->16268 16269 7ff60f186ed0 88 API calls 16267->16269 16270 7ff60f185b98 16268->16270 16271 7ff60f185b5c 16269->16271 16270->16101 16271->16266 16272 7ff60f185b66 16271->16272 16829 7ff60f19927c 16272->16829 16275 7ff60f18a110 _wfindfirst32i64 8 API calls 16276 7ff60f185b7e 16275->16276 16276->16101 16278 7ff60f186dc0 88 API calls 16277->16278 16279 7ff60f186117 SetEnvironmentVariableW 16278->16279 16280 7ff60f18612f __vcrt_freefls 16279->16280 16280->16105 16282 7ff60f181b30 49 API calls 16281->16282 16283 7ff60f181a00 16282->16283 16284 7ff60f181b30 49 API calls 16283->16284 16290 7ff60f181a7a 16283->16290 16285 7ff60f181a22 16284->16285 16286 7ff60f182c50 49 API calls 16285->16286 16285->16290 16287 7ff60f181a3b 16286->16287 16836 7ff60f1817b0 16287->16836 16290->16108 16290->16110 16291 7ff60f18e61c 74 API calls 16291->16290 16293 7ff60f186e67 MultiByteToWideChar 16292->16293 16294 7ff60f186de1 MultiByteToWideChar 16292->16294 16295 7ff60f186e8a 16293->16295 16296 7ff60f186eaf 16293->16296 16297 7ff60f186e07 16294->16297 16302 7ff60f186e2c 16294->16302 16298 7ff60f181cb0 86 API calls 16295->16298 16296->16118 16299 7ff60f181cb0 86 API calls 16297->16299 16300 7ff60f186e9d 16298->16300 16301 7ff60f186e1a 16299->16301 16300->16118 16301->16118 16302->16293 16303 7ff60f186e42 16302->16303 16304 7ff60f181cb0 86 API calls 16303->16304 16305 7ff60f186e55 16304->16305 16305->16118 16307 7ff60f184fb5 16306->16307 16308 7ff60f1829e0 16307->16308 16309 7ff60f181c10 86 API calls 16307->16309 16308->16155 16403 7ff60f184c40 16308->16403 16309->16308 16312 7ff60f1823e4 16310->16312 16319 7ff60f1823a3 16310->16319 16311 7ff60f182423 16313 7ff60f18a110 _wfindfirst32i64 8 API calls 16311->16313 16312->16311 16314 7ff60f181ab0 74 API calls 16312->16314 16315 7ff60f182435 16313->16315 16314->16312 16315->16158 16320 7ff60f186090 16315->16320 16319->16312 16909 7ff60f181440 16319->16909 16943 7ff60f181dc0 16319->16943 16998 7ff60f181780 16319->16998 16321 7ff60f186dc0 88 API calls 16320->16321 16322 7ff60f1860af 16321->16322 16323 7ff60f186dc0 88 API calls 16322->16323 16324 7ff60f1860bf 16323->16324 16325 7ff60f196828 38 API calls 16324->16325 16326 7ff60f1860cd __vcrt_freefls 16325->16326 16326->16147 16328 7ff60f186150 16327->16328 16329 7ff60f186dc0 88 API calls 16328->16329 16330 7ff60f186181 SetConsoleCtrlHandler GetStartupInfoW 16329->16330 16331 7ff60f1861e2 16330->16331 17792 7ff60f1992f4 16331->17792 16371 7ff60f181c6e 16370->16371 16372 7ff60f181b90 78 API calls 16371->16372 16373 7ff60f181c8c 16372->16373 16374 7ff60f181d00 86 API calls 16373->16374 16375 7ff60f181c9b 16374->16375 16375->16158 16377 7ff60f182dec 16376->16377 16378 7ff60f186dc0 88 API calls 16377->16378 16379 7ff60f182e17 16378->16379 16380 7ff60f186dc0 88 API calls 16379->16380 16381 7ff60f182e2a 16380->16381 17848 7ff60f195548 16381->17848 16384 7ff60f18a110 _wfindfirst32i64 8 API calls 16385 7ff60f18290a 16384->16385 16385->16128 16386 7ff60f186370 16385->16386 16387 7ff60f186394 16386->16387 16388 7ff60f18eca4 73 API calls 16387->16388 16391 7ff60f18646b __vcrt_freefls 16387->16391 16389 7ff60f1863ae 16388->16389 16389->16391 18227 7ff60f197aac 16389->18227 16391->16131 16392 7ff60f18eca4 73 API calls 16394 7ff60f1863c3 16392->16394 16393 7ff60f18e96c _fread_nolock 53 API calls 16393->16394 16394->16391 16394->16392 16394->16393 16396 7ff60f18e64c 16395->16396 18242 7ff60f18e3f8 16396->18242 16398 7ff60f18e665 16398->16128 16400 7ff60f1824b7 16399->16400 16401 7ff60f1824e0 16399->16401 16400->16401 16402 7ff60f181780 86 API calls 16400->16402 16401->16111 16402->16400 16404 7ff60f184c64 16403->16404 16409 7ff60f184c91 16403->16409 16405 7ff60f184c8c 16404->16405 16406 7ff60f184c87 memcpy_s __vcrt_freefls 16404->16406 16407 7ff60f181780 86 API calls 16404->16407 16404->16409 18253 7ff60f1812b0 16405->18253 16406->16133 16407->16404 16409->16406 18279 7ff60f182e60 16409->18279 16411 7ff60f184cf7 16411->16406 16412 7ff60f181c50 86 API calls 16411->16412 16412->16406 16414 7ff60f1847ba memcpy_s 16413->16414 16415 7ff60f1848df 16414->16415 16417 7ff60f1848fb 16414->16417 16421 7ff60f182e60 49 API calls 16414->16421 16422 7ff60f1848c0 16414->16422 16430 7ff60f181440 158 API calls 16414->16430 16431 7ff60f1848e1 16414->16431 18282 7ff60f181650 16414->18282 16418 7ff60f182e60 49 API calls 16415->16418 16419 7ff60f181c50 86 API calls 16417->16419 16420 7ff60f184958 16418->16420 16425 7ff60f1848f1 __vcrt_freefls 16419->16425 16423 7ff60f182e60 49 API calls 16420->16423 16421->16414 16422->16415 16426 7ff60f182e60 49 API calls 16422->16426 16424 7ff60f184988 16423->16424 16429 7ff60f182e60 49 API calls 16424->16429 16427 7ff60f18a110 _wfindfirst32i64 8 API calls 16425->16427 16426->16415 16428 7ff60f182a09 16427->16428 16428->16142 16433 7ff60f184720 16428->16433 16429->16425 16430->16414 16432 7ff60f181c50 86 API calls 16431->16432 16432->16425 18287 7ff60f186320 16433->18287 16435 7ff60f18473c 16436 7ff60f186320 89 API calls 16435->16436 16437 7ff60f18474f 16436->16437 16438 7ff60f184785 16437->16438 16439 7ff60f184767 16437->16439 16440 7ff60f181c50 86 API calls 16438->16440 18291 7ff60f1850b0 GetProcAddress 16439->18291 16442 7ff60f182a17 16440->16442 16442->16142 16442->16150 16444 7ff60f184e14 16443->16444 16445 7ff60f181c50 86 API calls 16444->16445 16448 7ff60f184e8a 16444->16448 16446 7ff60f184e6e 16445->16446 16448->16155 16450 7ff60f181b55 16449->16450 16451 7ff60f193c90 49 API calls 16450->16451 16452 7ff60f181b78 16451->16452 16452->16148 18350 7ff60f183ac0 16453->18350 16456 7ff60f18231d 16456->16154 16458 7ff60f1822f4 16458->16456 18406 7ff60f183840 16458->18406 16492 7ff60f181d00 16485->16492 16493 7ff60f181d10 16492->16493 16517 7ff60f193c90 16493->16517 16497 7ff60f181d70 16550 7ff60f181b90 16497->16550 16500 7ff60f18a110 _wfindfirst32i64 8 API calls 16501 7ff60f181cd7 GetLastError 16500->16501 16502 7ff60f186680 16501->16502 16503 7ff60f18668c 16502->16503 16504 7ff60f1866ad FormatMessageW 16503->16504 16505 7ff60f1866a7 GetLastError 16503->16505 16506 7ff60f1866fc WideCharToMultiByte 16504->16506 16507 7ff60f1866e0 16504->16507 16505->16504 16508 7ff60f186736 16506->16508 16509 7ff60f1866f3 16506->16509 16510 7ff60f181cb0 83 API calls 16507->16510 16511 7ff60f181cb0 83 API calls 16508->16511 16512 7ff60f18a110 _wfindfirst32i64 8 API calls 16509->16512 16510->16509 16511->16509 16513 7ff60f181ce4 16512->16513 16514 7ff60f181be0 16513->16514 16515 7ff60f181d00 86 API calls 16514->16515 16516 7ff60f181c02 16515->16516 16516->16235 16520 7ff60f193cea 16517->16520 16518 7ff60f193d0f 16519 7ff60f199e54 _invalid_parameter_noinfo 37 API calls 16518->16519 16534 7ff60f193d39 16519->16534 16520->16518 16521 7ff60f193d4b 16520->16521 16554 7ff60f1916d4 16521->16554 16524 7ff60f193e28 16526 7ff60f199f88 __free_lconv_mon 11 API calls 16524->16526 16525 7ff60f18a110 _wfindfirst32i64 8 API calls 16527 7ff60f181d58 16525->16527 16526->16534 16535 7ff60f186c00 MultiByteToWideChar 16527->16535 16528 7ff60f193dfd 16530 7ff60f199f88 __free_lconv_mon 11 API calls 16528->16530 16529 7ff60f193e4c 16529->16524 16532 7ff60f193e56 16529->16532 16530->16534 16531 7ff60f193df4 16531->16524 16531->16528 16533 7ff60f199f88 __free_lconv_mon 11 API calls 16532->16533 16533->16534 16534->16525 16536 7ff60f186c49 16535->16536 16537 7ff60f186c63 16535->16537 16538 7ff60f181cb0 82 API calls 16536->16538 16539 7ff60f186c79 16537->16539 16540 7ff60f186c93 MultiByteToWideChar 16537->16540 16549 7ff60f186c5c __vcrt_freefls 16538->16549 16541 7ff60f181cb0 82 API calls 16539->16541 16542 7ff60f186cb6 16540->16542 16543 7ff60f186cd0 WideCharToMultiByte 16540->16543 16541->16549 16544 7ff60f181cb0 82 API calls 16542->16544 16545 7ff60f186cfd 16543->16545 16546 7ff60f186d06 16543->16546 16544->16549 16547 7ff60f181cb0 82 API calls 16545->16547 16546->16545 16548 7ff60f186d2b WideCharToMultiByte 16546->16548 16547->16549 16548->16545 16548->16549 16549->16497 16551 7ff60f181bb6 16550->16551 16770 7ff60f193b6c 16551->16770 16553 7ff60f181bcc 16553->16500 16555 7ff60f191712 16554->16555 16556 7ff60f191702 16554->16556 16557 7ff60f19171b 16555->16557 16564 7ff60f191749 16555->16564 16560 7ff60f199e54 _invalid_parameter_noinfo 37 API calls 16556->16560 16558 7ff60f199e54 _invalid_parameter_noinfo 37 API calls 16557->16558 16559 7ff60f191741 16558->16559 16559->16524 16559->16528 16559->16529 16559->16531 16560->16559 16563 7ff60f1919f8 16566 7ff60f199e54 _invalid_parameter_noinfo 37 API calls 16563->16566 16564->16556 16564->16559 16564->16563 16568 7ff60f192624 16564->16568 16594 7ff60f191eb4 16564->16594 16624 7ff60f19121c 16564->16624 16627 7ff60f193840 16564->16627 16566->16556 16569 7ff60f192666 16568->16569 16570 7ff60f1926d9 16568->16570 16571 7ff60f192703 16569->16571 16572 7ff60f19266c 16569->16572 16573 7ff60f1926de 16570->16573 16574 7ff60f192733 16570->16574 16651 7ff60f190160 16571->16651 16581 7ff60f192671 16572->16581 16585 7ff60f192742 16572->16585 16575 7ff60f1926e0 16573->16575 16576 7ff60f192713 16573->16576 16574->16571 16574->16585 16591 7ff60f19269c 16574->16591 16578 7ff60f192681 16575->16578 16584 7ff60f1926ef 16575->16584 16658 7ff60f18fd50 16576->16658 16593 7ff60f192771 16578->16593 16633 7ff60f192f88 16578->16633 16581->16578 16583 7ff60f1926b4 16581->16583 16581->16591 16583->16593 16643 7ff60f193444 16583->16643 16584->16571 16586 7ff60f1926f4 16584->16586 16585->16593 16665 7ff60f190570 16585->16665 16586->16593 16647 7ff60f1935dc 16586->16647 16588 7ff60f18a110 _wfindfirst32i64 8 API calls 16590 7ff60f192a07 16588->16590 16590->16564 16591->16593 16672 7ff60f19db70 16591->16672 16593->16588 16595 7ff60f191ebf 16594->16595 16596 7ff60f191ed5 16594->16596 16598 7ff60f192666 16595->16598 16599 7ff60f1926d9 16595->16599 16600 7ff60f191f13 16595->16600 16597 7ff60f199e54 _invalid_parameter_noinfo 37 API calls 16596->16597 16596->16600 16597->16600 16601 7ff60f192703 16598->16601 16602 7ff60f19266c 16598->16602 16603 7ff60f1926de 16599->16603 16604 7ff60f192733 16599->16604 16600->16564 16607 7ff60f190160 38 API calls 16601->16607 16611 7ff60f192671 16602->16611 16613 7ff60f192742 16602->16613 16605 7ff60f1926e0 16603->16605 16606 7ff60f192713 16603->16606 16604->16601 16604->16613 16622 7ff60f19269c 16604->16622 16608 7ff60f192681 16605->16608 16615 7ff60f1926ef 16605->16615 16609 7ff60f18fd50 38 API calls 16606->16609 16607->16622 16610 7ff60f192f88 47 API calls 16608->16610 16623 7ff60f192771 16608->16623 16609->16622 16610->16622 16611->16608 16612 7ff60f1926b4 16611->16612 16611->16622 16616 7ff60f193444 47 API calls 16612->16616 16612->16623 16614 7ff60f190570 38 API calls 16613->16614 16613->16623 16614->16622 16615->16601 16617 7ff60f1926f4 16615->16617 16616->16622 16619 7ff60f1935dc 37 API calls 16617->16619 16617->16623 16618 7ff60f18a110 _wfindfirst32i64 8 API calls 16620 7ff60f192a07 16618->16620 16619->16622 16620->16564 16621 7ff60f19db70 47 API calls 16621->16622 16622->16621 16622->16623 16623->16618 16745 7ff60f18f324 16624->16745 16628 7ff60f193857 16627->16628 16762 7ff60f19ccd0 16628->16762 16634 7ff60f192faa 16633->16634 16682 7ff60f18f190 16634->16682 16639 7ff60f193840 45 API calls 16641 7ff60f1930e7 16639->16641 16640 7ff60f193840 45 API calls 16642 7ff60f193170 16640->16642 16641->16640 16641->16641 16641->16642 16642->16591 16644 7ff60f1934c4 16643->16644 16645 7ff60f19345c 16643->16645 16644->16591 16645->16644 16646 7ff60f19db70 47 API calls 16645->16646 16646->16644 16650 7ff60f1935fd 16647->16650 16648 7ff60f199e54 _invalid_parameter_noinfo 37 API calls 16649 7ff60f19362e 16648->16649 16649->16591 16650->16648 16650->16649 16652 7ff60f190193 16651->16652 16653 7ff60f1901c2 16652->16653 16655 7ff60f19027f 16652->16655 16654 7ff60f18f190 12 API calls 16653->16654 16657 7ff60f1901ff 16653->16657 16654->16657 16656 7ff60f199e54 _invalid_parameter_noinfo 37 API calls 16655->16656 16656->16657 16657->16591 16659 7ff60f18fd83 16658->16659 16660 7ff60f18fdb2 16659->16660 16662 7ff60f18fe6f 16659->16662 16661 7ff60f18f190 12 API calls 16660->16661 16664 7ff60f18fdef 16660->16664 16661->16664 16663 7ff60f199e54 _invalid_parameter_noinfo 37 API calls 16662->16663 16663->16664 16664->16591 16666 7ff60f1905a3 16665->16666 16667 7ff60f1905d2 16666->16667 16669 7ff60f19068f 16666->16669 16668 7ff60f18f190 12 API calls 16667->16668 16671 7ff60f19060f 16667->16671 16668->16671 16670 7ff60f199e54 _invalid_parameter_noinfo 37 API calls 16669->16670 16670->16671 16671->16591 16673 7ff60f19db98 16672->16673 16674 7ff60f19dbdd 16673->16674 16676 7ff60f193840 45 API calls 16673->16676 16678 7ff60f19db9d memcpy_s 16673->16678 16681 7ff60f19dbc6 memcpy_s 16673->16681 16677 7ff60f19f148 WideCharToMultiByte 16674->16677 16674->16678 16674->16681 16675 7ff60f199e54 _invalid_parameter_noinfo 37 API calls 16675->16678 16676->16674 16679 7ff60f19dcb9 16677->16679 16678->16591 16679->16678 16680 7ff60f19dcce GetLastError 16679->16680 16680->16678 16680->16681 16681->16675 16681->16678 16683 7ff60f18f1c7 16682->16683 16684 7ff60f18f1b6 16682->16684 16683->16684 16685 7ff60f19cc3c _fread_nolock 12 API calls 16683->16685 16690 7ff60f19d888 16684->16690 16686 7ff60f18f1f4 16685->16686 16687 7ff60f18f208 16686->16687 16689 7ff60f199f88 __free_lconv_mon 11 API calls 16686->16689 16688 7ff60f199f88 __free_lconv_mon 11 API calls 16687->16688 16688->16684 16689->16687 16691 7ff60f19d8a5 16690->16691 16692 7ff60f19d8d8 16690->16692 16693 7ff60f199e54 _invalid_parameter_noinfo 37 API calls 16691->16693 16692->16691 16694 7ff60f19d90a 16692->16694 16703 7ff60f1930c5 16693->16703 16699 7ff60f19da1d 16694->16699 16707 7ff60f19d952 16694->16707 16695 7ff60f19db0f 16736 7ff60f19cd74 16695->16736 16697 7ff60f19dad5 16729 7ff60f19d10c 16697->16729 16699->16695 16699->16697 16700 7ff60f19daa4 16699->16700 16702 7ff60f19da67 16699->16702 16705 7ff60f19da5d 16699->16705 16722 7ff60f19d3ec 16700->16722 16712 7ff60f19d61c 16702->16712 16703->16639 16703->16641 16705->16697 16706 7ff60f19da62 16705->16706 16706->16700 16706->16702 16707->16703 16708 7ff60f19931c __std_exception_copy 37 API calls 16707->16708 16709 7ff60f19da0a 16708->16709 16709->16703 16710 7ff60f199f40 _wfindfirst32i64 17 API calls 16709->16710 16711 7ff60f19db6c 16710->16711 16713 7ff60f1a325c 38 API calls 16712->16713 16714 7ff60f19d669 16713->16714 16715 7ff60f1a2ca4 37 API calls 16714->16715 16718 7ff60f19d6c4 16715->16718 16716 7ff60f19d6c8 16716->16703 16717 7ff60f19d719 16720 7ff60f19d208 45 API calls 16717->16720 16718->16716 16718->16717 16719 7ff60f19d6e4 16718->16719 16721 7ff60f19d4c4 45 API calls 16719->16721 16720->16716 16721->16716 16723 7ff60f1a325c 38 API calls 16722->16723 16724 7ff60f19d436 16723->16724 16725 7ff60f1a2ca4 37 API calls 16724->16725 16726 7ff60f19d486 16725->16726 16727 7ff60f19d48a 16726->16727 16728 7ff60f19d4c4 45 API calls 16726->16728 16727->16703 16728->16727 16730 7ff60f1a325c 38 API calls 16729->16730 16731 7ff60f19d157 16730->16731 16732 7ff60f1a2ca4 37 API calls 16731->16732 16733 7ff60f19d1af 16732->16733 16734 7ff60f19d1b3 16733->16734 16735 7ff60f19d208 45 API calls 16733->16735 16734->16703 16735->16734 16737 7ff60f19cdb9 16736->16737 16738 7ff60f19cdec 16736->16738 16739 7ff60f199e54 _invalid_parameter_noinfo 37 API calls 16737->16739 16740 7ff60f19ce04 16738->16740 16742 7ff60f19ce85 16738->16742 16744 7ff60f19cde5 memcpy_s 16739->16744 16741 7ff60f19d10c 46 API calls 16740->16741 16741->16744 16743 7ff60f193840 45 API calls 16742->16743 16742->16744 16743->16744 16744->16703 16746 7ff60f18f351 16745->16746 16747 7ff60f18f363 16745->16747 16748 7ff60f196098 memcpy_s 11 API calls 16746->16748 16749 7ff60f18f370 16747->16749 16755 7ff60f18f3ad 16747->16755 16750 7ff60f18f356 16748->16750 16751 7ff60f199e54 _invalid_parameter_noinfo 37 API calls 16749->16751 16752 7ff60f199f20 _invalid_parameter_noinfo 37 API calls 16750->16752 16753 7ff60f18f361 16751->16753 16752->16753 16753->16564 16754 7ff60f18f456 16754->16753 16757 7ff60f196098 memcpy_s 11 API calls 16754->16757 16755->16754 16756 7ff60f196098 memcpy_s 11 API calls 16755->16756 16758 7ff60f18f44b 16756->16758 16759 7ff60f18f500 16757->16759 16760 7ff60f199f20 _invalid_parameter_noinfo 37 API calls 16758->16760 16761 7ff60f199f20 _invalid_parameter_noinfo 37 API calls 16759->16761 16760->16754 16761->16753 16763 7ff60f19cce9 16762->16763 16765 7ff60f19387f 16762->16765 16764 7ff60f1a24b4 45 API calls 16763->16764 16763->16765 16764->16765 16766 7ff60f19cd3c 16765->16766 16767 7ff60f19cd55 16766->16767 16768 7ff60f19388f 16766->16768 16767->16768 16769 7ff60f1a1820 45 API calls 16767->16769 16768->16564 16769->16768 16772 7ff60f193b96 16770->16772 16771 7ff60f193bce 16773 7ff60f199e54 _invalid_parameter_noinfo 37 API calls 16771->16773 16772->16771 16774 7ff60f193c01 16772->16774 16776 7ff60f193bf7 16773->16776 16777 7ff60f18f150 16774->16777 16776->16553 16784 7ff60f19439c EnterCriticalSection 16777->16784 16792 7ff60f19439c EnterCriticalSection 16785->16792 16794 7ff60f181d00 86 API calls 16793->16794 16795 7ff60f181c37 16794->16795 16798 7ff60f1944f0 16795->16798 16799 7ff60f19451b 16798->16799 16802 7ff60f1943b4 16799->16802 16815 7ff60f196d60 EnterCriticalSection 16802->16815 16817 7ff60f182cdc GetModuleFileNameW 16816->16817 16817->16250 16817->16251 16819 7ff60f186ef4 WideCharToMultiByte 16818->16819 16820 7ff60f186f62 WideCharToMultiByte 16818->16820 16823 7ff60f186f35 16819->16823 16824 7ff60f186f1e 16819->16824 16821 7ff60f182d35 16820->16821 16822 7ff60f186f8f 16820->16822 16821->16254 16821->16257 16826 7ff60f181cb0 86 API calls 16822->16826 16823->16820 16827 7ff60f186f4b 16823->16827 16825 7ff60f181cb0 86 API calls 16824->16825 16825->16821 16826->16821 16828 7ff60f181cb0 86 API calls 16827->16828 16828->16821 16830 7ff60f185b6e 16829->16830 16831 7ff60f199293 16829->16831 16830->16275 16831->16830 16832 7ff60f19931c __std_exception_copy 37 API calls 16831->16832 16833 7ff60f1992c0 16832->16833 16833->16830 16834 7ff60f199f40 _wfindfirst32i64 17 API calls 16833->16834 16835 7ff60f1992f0 16834->16835 16837 7ff60f1817d4 16836->16837 16838 7ff60f1817e4 16836->16838 16839 7ff60f182de0 120 API calls 16837->16839 16840 7ff60f186370 83 API calls 16838->16840 16866 7ff60f181842 16838->16866 16839->16838 16841 7ff60f181815 16840->16841 16841->16866 16870 7ff60f18eca4 16841->16870 16843 7ff60f18a110 _wfindfirst32i64 8 API calls 16845 7ff60f1819c0 16843->16845 16844 7ff60f18182b 16846 7ff60f18184c 16844->16846 16847 7ff60f18182f 16844->16847 16845->16290 16845->16291 16874 7ff60f18e96c 16846->16874 16849 7ff60f181c10 86 API calls 16847->16849 16849->16866 16851 7ff60f181867 16853 7ff60f181c10 86 API calls 16851->16853 16852 7ff60f18eca4 73 API calls 16854 7ff60f1818d1 16852->16854 16853->16866 16855 7ff60f1818e3 16854->16855 16856 7ff60f1818fe 16854->16856 16857 7ff60f181c10 86 API calls 16855->16857 16858 7ff60f18e96c _fread_nolock 53 API calls 16856->16858 16857->16866 16859 7ff60f181913 16858->16859 16859->16851 16860 7ff60f181925 16859->16860 16877 7ff60f18e6e0 16860->16877 16863 7ff60f18193d 16864 7ff60f181c50 86 API calls 16863->16864 16864->16866 16865 7ff60f181993 16865->16866 16867 7ff60f18e61c 74 API calls 16865->16867 16866->16843 16867->16866 16868 7ff60f181950 16868->16865 16869 7ff60f181c50 86 API calls 16868->16869 16869->16865 16871 7ff60f18ecd4 16870->16871 16883 7ff60f18ea34 16871->16883 16873 7ff60f18eced 16873->16844 16895 7ff60f18e98c 16874->16895 16878 7ff60f18e6e9 16877->16878 16879 7ff60f181939 16877->16879 16880 7ff60f196098 memcpy_s 11 API calls 16878->16880 16879->16863 16879->16868 16881 7ff60f18e6ee 16880->16881 16882 7ff60f199f20 _invalid_parameter_noinfo 37 API calls 16881->16882 16882->16879 16884 7ff60f18ea9e 16883->16884 16885 7ff60f18ea5e 16883->16885 16884->16885 16887 7ff60f18eaaa 16884->16887 16886 7ff60f199e54 _invalid_parameter_noinfo 37 API calls 16885->16886 16888 7ff60f18ea85 16886->16888 16894 7ff60f19439c EnterCriticalSection 16887->16894 16888->16873 16896 7ff60f181861 16895->16896 16897 7ff60f18e9b6 16895->16897 16896->16851 16896->16852 16897->16896 16898 7ff60f18ea02 16897->16898 16899 7ff60f18e9c5 memcpy_s 16897->16899 16908 7ff60f19439c EnterCriticalSection 16898->16908 16901 7ff60f196098 memcpy_s 11 API calls 16899->16901 16903 7ff60f18e9da 16901->16903 16905 7ff60f199f20 _invalid_parameter_noinfo 37 API calls 16903->16905 16905->16896 17002 7ff60f185880 16909->17002 16911 7ff60f181454 16912 7ff60f181459 16911->16912 17011 7ff60f185ba0 16911->17011 16912->16319 16915 7ff60f1814a7 16918 7ff60f1814e0 16915->16918 16920 7ff60f182de0 120 API calls 16915->16920 16916 7ff60f181487 16917 7ff60f181c10 86 API calls 16916->16917 16937 7ff60f18149d 16917->16937 16919 7ff60f18eca4 73 API calls 16918->16919 16921 7ff60f1814f2 16919->16921 16922 7ff60f1814bf 16920->16922 16923 7ff60f181516 16921->16923 16924 7ff60f1814f6 16921->16924 16922->16918 16925 7ff60f1814c7 16922->16925 16928 7ff60f18151c 16923->16928 16929 7ff60f181534 16923->16929 16927 7ff60f181c10 86 API calls 16924->16927 16926 7ff60f181c50 86 API calls 16925->16926 16936 7ff60f1814d6 __vcrt_freefls 16926->16936 16927->16936 17036 7ff60f181050 16928->17036 16932 7ff60f181556 16929->16932 16941 7ff60f181575 16929->16941 16931 7ff60f181624 16935 7ff60f18e61c 74 API calls 16931->16935 16933 7ff60f181c10 86 API calls 16932->16933 16933->16936 16934 7ff60f18e61c 74 API calls 16934->16931 16935->16937 16936->16931 16936->16934 16937->16319 16938 7ff60f18e96c _fread_nolock 53 API calls 16938->16941 16939 7ff60f1815d5 16942 7ff60f181c10 86 API calls 16939->16942 16941->16936 16941->16938 16941->16939 17054 7ff60f18f0ac 16941->17054 16942->16936 16944 7ff60f181dd6 16943->16944 16945 7ff60f181b30 49 API calls 16944->16945 16946 7ff60f181e0b 16945->16946 16947 7ff60f182c50 49 API calls 16946->16947 16975 7ff60f182211 16946->16975 16948 7ff60f181e7f 16947->16948 17604 7ff60f182230 16948->17604 16951 7ff60f181efa 16953 7ff60f182230 75 API calls 16951->16953 16952 7ff60f181ec1 16954 7ff60f185880 127 API calls 16952->16954 16955 7ff60f181f4c 16953->16955 16956 7ff60f181ec9 16954->16956 16957 7ff60f181fb6 16955->16957 16958 7ff60f181f50 16955->16958 16959 7ff60f181eea 16956->16959 17612 7ff60f185760 16956->17612 16960 7ff60f182230 75 API calls 16957->16960 16961 7ff60f185880 127 API calls 16958->16961 16962 7ff60f181c50 86 API calls 16959->16962 16966 7ff60f181ef3 16959->16966 16964 7ff60f181fe2 16960->16964 16965 7ff60f181f58 16961->16965 16962->16966 16967 7ff60f182230 75 API calls 16964->16967 16978 7ff60f182042 16964->16978 16965->16959 16968 7ff60f185760 138 API calls 16965->16968 16970 7ff60f18a110 _wfindfirst32i64 8 API calls 16966->16970 16971 7ff60f182012 16967->16971 16972 7ff60f181f75 16968->16972 16969 7ff60f185880 127 API calls 16979 7ff60f182052 16969->16979 16973 7ff60f181fab 16970->16973 16976 7ff60f182230 75 API calls 16971->16976 16971->16978 16972->16959 16974 7ff60f1821f6 16972->16974 16973->16319 16981 7ff60f181c50 86 API calls 16974->16981 16976->16978 16977 7ff60f181af0 86 API calls 16978->16969 16978->16975 16979->16975 16979->16977 16991 7ff60f18216f 16979->16991 16999 7ff60f1817a1 16998->16999 17000 7ff60f181795 16998->17000 16999->16319 17001 7ff60f181c50 86 API calls 17000->17001 17001->16999 17003 7ff60f1858c8 17002->17003 17004 7ff60f185892 17002->17004 17003->16911 17058 7ff60f1816d0 17004->17058 17012 7ff60f185bb0 17011->17012 17013 7ff60f181b30 49 API calls 17012->17013 17014 7ff60f185be1 17013->17014 17015 7ff60f185db0 17014->17015 17016 7ff60f181b30 49 API calls 17014->17016 17017 7ff60f18a110 _wfindfirst32i64 8 API calls 17015->17017 17019 7ff60f185c08 17016->17019 17018 7ff60f18147f 17017->17018 17018->16915 17018->16916 17019->17015 17567 7ff60f195168 17019->17567 17021 7ff60f185c3d 17021->17015 17022 7ff60f185d19 17021->17022 17032 7ff60f195168 49 API calls 17021->17032 17034 7ff60f186dc0 88 API calls 17021->17034 17035 7ff60f186a70 58 API calls 17021->17035 17023 7ff60f186dc0 88 API calls 17022->17023 17025 7ff60f185d31 17023->17025 17024 7ff60f185deb 17026 7ff60f182de0 120 API calls 17024->17026 17025->17024 17029 7ff60f185af0 92 API calls 17025->17029 17033 7ff60f185d62 __vcrt_freefls 17025->17033 17026->17015 17027 7ff60f185dd3 17031 7ff60f181c50 86 API calls 17027->17031 17028 7ff60f185d9f 17030 7ff60f181c50 86 API calls 17028->17030 17029->17033 17030->17015 17031->17024 17032->17021 17033->17027 17033->17028 17034->17021 17035->17021 17037 7ff60f1810a6 17036->17037 17038 7ff60f1810ad 17037->17038 17039 7ff60f1810d3 17037->17039 17040 7ff60f181c50 86 API calls 17038->17040 17042 7ff60f1810ed 17039->17042 17044 7ff60f181109 17039->17044 17041 7ff60f1810c0 17040->17041 17041->16936 17043 7ff60f181c10 86 API calls 17042->17043 17049 7ff60f181104 __vcrt_freefls 17043->17049 17045 7ff60f18111b 17044->17045 17053 7ff60f181137 memcpy_s 17044->17053 17046 7ff60f181c10 86 API calls 17045->17046 17046->17049 17047 7ff60f18e96c _fread_nolock 53 API calls 17047->17053 17048 7ff60f18e6e0 37 API calls 17048->17053 17049->16936 17050 7ff60f1811fe 17052 7ff60f18f0ac 76 API calls 17052->17053 17053->17047 17053->17048 17053->17049 17053->17050 17053->17052 17055 7ff60f18f0dc 17054->17055 17589 7ff60f18edfc 17055->17589 17057 7ff60f18f0fa 17057->16941 17060 7ff60f1816f5 17058->17060 17059 7ff60f181738 17062 7ff60f1858e0 17059->17062 17060->17059 17061 7ff60f181c50 86 API calls 17060->17061 17061->17059 17063 7ff60f1858f6 17062->17063 17064 7ff60f18596d GetTempPathW GetCurrentProcessId 17063->17064 17065 7ff60f18591a 17063->17065 17100 7ff60f186620 17064->17100 17067 7ff60f185af0 92 API calls 17065->17067 17068 7ff60f185926 17067->17068 17124 7ff60f1855e0 17068->17124 17074 7ff60f18a110 _wfindfirst32i64 8 API calls 17076 7ff60f1858ad 17074->17076 17076->17003 17077 7ff60f185a46 17079 7ff60f186ed0 88 API calls 17077->17079 17078 7ff60f18599b __vcrt_freefls 17078->17077 17081 7ff60f1859d1 17078->17081 17104 7ff60f1974e0 17078->17104 17107 7ff60f186a70 17078->17107 17085 7ff60f185a57 __vcrt_freefls 17079->17085 17084 7ff60f186dc0 88 API calls 17081->17084 17094 7ff60f185a0a __vcrt_freefls 17081->17094 17086 7ff60f1859e7 17084->17086 17087 7ff60f186dc0 88 API calls 17085->17087 17085->17094 17088 7ff60f1859ec 17086->17088 17089 7ff60f185a29 SetEnvironmentVariableW 17086->17089 17089->17094 17094->17074 17101 7ff60f186645 17100->17101 17158 7ff60f193ee4 17101->17158 17330 7ff60f19710c 17104->17330 17108 7ff60f18a140 17107->17108 17109 7ff60f186a80 GetCurrentProcess OpenProcessToken 17108->17109 17110 7ff60f186acb GetTokenInformation 17109->17110 17111 7ff60f186b41 __vcrt_freefls 17109->17111 17125 7ff60f1855ec 17124->17125 17126 7ff60f186dc0 88 API calls 17125->17126 17127 7ff60f18560e 17126->17127 17128 7ff60f185629 ExpandEnvironmentStringsW 17127->17128 17129 7ff60f185616 17127->17129 17131 7ff60f18564f __vcrt_freefls 17128->17131 17130 7ff60f181c50 86 API calls 17129->17130 17137 7ff60f185622 17130->17137 17132 7ff60f185666 17131->17132 17133 7ff60f185653 17131->17133 17138 7ff60f185674 17132->17138 17139 7ff60f185680 17132->17139 17135 7ff60f181c50 86 API calls 17133->17135 17134 7ff60f18a110 _wfindfirst32i64 8 API calls 17136 7ff60f185748 17134->17136 17135->17137 17136->17094 17148 7ff60f196828 17136->17148 17137->17134 17460 7ff60f1960b8 17138->17460 17467 7ff60f1953c8 17139->17467 17142 7ff60f18567e 17143 7ff60f18569a 17142->17143 17146 7ff60f1856ad memcpy_s 17142->17146 17149 7ff60f196835 17148->17149 17150 7ff60f196848 17148->17150 17160 7ff60f193f3e 17158->17160 17159 7ff60f193f63 17161 7ff60f199e54 _invalid_parameter_noinfo 37 API calls 17159->17161 17160->17159 17162 7ff60f193f9f 17160->17162 17165 7ff60f193f8d 17161->17165 17176 7ff60f191a54 17162->17176 17164 7ff60f194080 17167 7ff60f199f88 __free_lconv_mon 11 API calls 17164->17167 17166 7ff60f18a110 _wfindfirst32i64 8 API calls 17165->17166 17168 7ff60f186664 17166->17168 17167->17165 17168->17078 17170 7ff60f194055 17173 7ff60f199f88 __free_lconv_mon 11 API calls 17170->17173 17171 7ff60f1940a6 17171->17164 17172 7ff60f1940b0 17171->17172 17175 7ff60f199f88 __free_lconv_mon 11 API calls 17172->17175 17173->17165 17174 7ff60f19404c 17174->17164 17174->17170 17175->17165 17177 7ff60f191a92 17176->17177 17182 7ff60f191a82 17176->17182 17178 7ff60f191a9b 17177->17178 17183 7ff60f191ac9 17177->17183 17179 7ff60f199e54 _invalid_parameter_noinfo 37 API calls 17178->17179 17180 7ff60f191ac1 17179->17180 17180->17164 17180->17170 17180->17171 17180->17174 17181 7ff60f199e54 _invalid_parameter_noinfo 37 API calls 17181->17180 17182->17181 17183->17180 17183->17182 17187 7ff60f192a28 17183->17187 17220 7ff60f19203c 17183->17220 17257 7ff60f1912ac 17183->17257 17188 7ff60f192a6a 17187->17188 17189 7ff60f192adb 17187->17189 17190 7ff60f192a70 17188->17190 17191 7ff60f192b05 17188->17191 17192 7ff60f192ae0 17189->17192 17193 7ff60f192b34 17189->17193 17194 7ff60f192aa4 17190->17194 17195 7ff60f192a75 17190->17195 17276 7ff60f190364 17191->17276 17196 7ff60f192ae2 17192->17196 17197 7ff60f192b15 17192->17197 17198 7ff60f192b3e 17193->17198 17199 7ff60f192b4b 17193->17199 17204 7ff60f192b43 17193->17204 17201 7ff60f192a7b 17194->17201 17194->17204 17195->17199 17195->17201 17202 7ff60f192a84 17196->17202 17207 7ff60f192af1 17196->17207 17283 7ff60f18ff54 17197->17283 17198->17191 17198->17204 17290 7ff60f193730 17199->17290 17201->17202 17208 7ff60f192ab6 17201->17208 17215 7ff60f192a9f 17201->17215 17218 7ff60f192b74 17202->17218 17260 7ff60f1931dc 17202->17260 17204->17218 17294 7ff60f190774 17204->17294 17207->17191 17210 7ff60f192af6 17207->17210 17208->17218 17210->17218 17212 7ff60f18a110 _wfindfirst32i64 8 API calls 17215->17218 17218->17212 17221 7ff60f192060 17220->17221 17222 7ff60f19204a 17220->17222 17223 7ff60f1920a0 17221->17223 17224 7ff60f199e54 _invalid_parameter_noinfo 37 API calls 17221->17224 17222->17223 17225 7ff60f192a6a 17222->17225 17226 7ff60f192adb 17222->17226 17223->17183 17224->17223 17227 7ff60f192a70 17225->17227 17228 7ff60f192b05 17225->17228 17229 7ff60f192ae0 17226->17229 17230 7ff60f192b34 17226->17230 17232 7ff60f192aa4 17227->17232 17233 7ff60f192a75 17227->17233 17238 7ff60f190364 38 API calls 17228->17238 17234 7ff60f192ae2 17229->17234 17235 7ff60f192b15 17229->17235 17231 7ff60f192b43 17230->17231 17236 7ff60f192b3e 17230->17236 17237 7ff60f192b4b 17230->17237 17245 7ff60f190774 38 API calls 17231->17245 17255 7ff60f192b74 17231->17255 17232->17231 17239 7ff60f192a7b 17232->17239 17233->17237 17233->17239 17243 7ff60f192af1 17234->17243 17247 7ff60f192a84 17234->17247 17240 7ff60f18ff54 38 API calls 17235->17240 17236->17228 17236->17231 17242 7ff60f193730 45 API calls 17237->17242 17252 7ff60f192a9f 17238->17252 17239->17247 17239->17252 17240->17252 17242->17252 17243->17228 17245->17252 17247->17255 17252->17255 17313 7ff60f18f5d8 17257->17313 17278 7ff60f190397 17276->17278 17284 7ff60f18ff87 17283->17284 17291 7ff60f193773 17290->17291 17295 7ff60f1907a7 17294->17295 17314 7ff60f18f61f 17313->17314 17315 7ff60f18f60d 17313->17315 17318 7ff60f18f62d 17314->17318 17322 7ff60f18f669 17314->17322 17316 7ff60f196098 memcpy_s 11 API calls 17315->17316 17317 7ff60f18f612 17316->17317 17319 7ff60f199f20 _invalid_parameter_noinfo 37 API calls 17317->17319 17320 7ff60f199e54 _invalid_parameter_noinfo 37 API calls 17318->17320 17321 7ff60f18f61d 17319->17321 17320->17321 17321->17183 17323 7ff60f18f9e5 17322->17323 17325 7ff60f196098 memcpy_s 11 API calls 17322->17325 17323->17321 17324 7ff60f196098 memcpy_s 11 API calls 17323->17324 17327 7ff60f18f9da 17325->17327 17371 7ff60f1a0728 17330->17371 17430 7ff60f1a04a0 17371->17430 17461 7ff60f1960d6 17460->17461 17464 7ff60f196109 17460->17464 17462 7ff60f19f9b4 _wfindfirst32i64 37 API calls 17461->17462 17461->17464 17463 7ff60f196105 17462->17463 17463->17464 17464->17142 17468 7ff60f195452 17467->17468 17469 7ff60f1953e4 17467->17469 17504 7ff60f19f120 17468->17504 17469->17468 17471 7ff60f1953e9 17469->17471 17473 7ff60f19541e 17471->17473 17474 7ff60f195401 17471->17474 17507 7ff60f19ef30 17504->17507 17568 7ff60f19a790 __CxxCallCatchBlock 45 API calls 17567->17568 17570 7ff60f19517d 17568->17570 17569 7ff60f19ef27 17576 7ff60f18a2a4 17569->17576 17570->17569 17575 7ff60f19ee46 17570->17575 17573 7ff60f18a110 _wfindfirst32i64 8 API calls 17574 7ff60f19ef1f 17573->17574 17574->17021 17575->17573 17579 7ff60f18a2b8 IsProcessorFeaturePresent 17576->17579 17580 7ff60f18a2cf 17579->17580 17585 7ff60f18a354 RtlCaptureContext RtlLookupFunctionEntry 17580->17585 17586 7ff60f18a384 RtlVirtualUnwind 17585->17586 17587 7ff60f18a2e3 17585->17587 17586->17587 17588 7ff60f18a190 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 17587->17588 17590 7ff60f18ee49 17589->17590 17591 7ff60f18ee1c 17589->17591 17590->17057 17591->17590 17592 7ff60f18ee51 17591->17592 17593 7ff60f18ee26 17591->17593 17605 7ff60f182264 17604->17605 17606 7ff60f193c90 49 API calls 17605->17606 17607 7ff60f18228a 17606->17607 17608 7ff60f18229b 17607->17608 17636 7ff60f194e80 17607->17636 17610 7ff60f18a110 _wfindfirst32i64 8 API calls 17608->17610 17611 7ff60f181ebd 17610->17611 17611->16951 17611->16952 17613 7ff60f18576e 17612->17613 17614 7ff60f182de0 120 API calls 17613->17614 17615 7ff60f185795 17614->17615 17616 7ff60f185ba0 138 API calls 17615->17616 17617 7ff60f1857a3 17616->17617 17618 7ff60f185853 17617->17618 17619 7ff60f1857bd 17617->17619 17637 7ff60f194ea9 17636->17637 17638 7ff60f194e9d 17636->17638 17640 7ff60f194a94 45 API calls 17637->17640 17653 7ff60f1946f8 17638->17653 17641 7ff60f194ed1 17640->17641 17642 7ff60f19e154 5 API calls 17641->17642 17643 7ff60f194ee1 17641->17643 17642->17643 17644 7ff60f19457c 14 API calls 17643->17644 17645 7ff60f194f39 17644->17645 17646 7ff60f194f51 17645->17646 17648 7ff60f194f3d 17645->17648 17647 7ff60f1946f8 69 API calls 17646->17647 17650 7ff60f194f5d 17647->17650 17649 7ff60f194ea2 17648->17649 17651 7ff60f199f88 __free_lconv_mon 11 API calls 17648->17651 17649->17608 17650->17649 17652 7ff60f199f88 __free_lconv_mon 11 API calls 17650->17652 17651->17649 17652->17649 17654 7ff60f19472f 17653->17654 17655 7ff60f194712 17653->17655 17654->17655 17657 7ff60f194742 CreateFileW 17654->17657 17656 7ff60f196078 _fread_nolock 11 API calls 17655->17656 17660 7ff60f194717 17656->17660 17658 7ff60f194776 17657->17658 17659 7ff60f1947ac 17657->17659 17678 7ff60f19484c GetFileType 17658->17678 17704 7ff60f194d70 17659->17704 17663 7ff60f196098 memcpy_s 11 API calls 17660->17663 17666 7ff60f19471f 17663->17666 17671 7ff60f199f20 _invalid_parameter_noinfo 37 API calls 17666->17671 17667 7ff60f1947a1 CloseHandle 17672 7ff60f19472a 17667->17672 17668 7ff60f19478b CloseHandle 17668->17672 17669 7ff60f1947e0 17725 7ff60f194b30 17669->17725 17670 7ff60f1947b5 17673 7ff60f19600c _fread_nolock 11 API calls 17670->17673 17671->17672 17672->17649 17679 7ff60f194957 17678->17679 17680 7ff60f19489a 17678->17680 17682 7ff60f19495f 17679->17682 17683 7ff60f194981 17679->17683 17681 7ff60f1948c6 GetFileInformationByHandle 17680->17681 17684 7ff60f194c6c 21 API calls 17680->17684 17685 7ff60f1948ef 17681->17685 17686 7ff60f194972 GetLastError 17681->17686 17682->17686 17687 7ff60f194963 17682->17687 17688 7ff60f1949a4 PeekNamedPipe 17683->17688 17693 7ff60f194942 17683->17693 17694 7ff60f1948b4 17684->17694 17689 7ff60f194b30 51 API calls 17685->17689 17691 7ff60f19600c _fread_nolock 11 API calls 17686->17691 17690 7ff60f196098 memcpy_s 11 API calls 17687->17690 17688->17693 17695 7ff60f1948fa 17689->17695 17690->17693 17691->17693 17692 7ff60f18a110 _wfindfirst32i64 8 API calls 17696 7ff60f194784 17692->17696 17693->17692 17694->17681 17694->17693 17742 7ff60f1949f4 17695->17742 17696->17667 17696->17668 17705 7ff60f194da6 17704->17705 17706 7ff60f196098 memcpy_s 11 API calls 17705->17706 17724 7ff60f194e3e __vcrt_freefls 17705->17724 17708 7ff60f194db8 17706->17708 17707 7ff60f18a110 _wfindfirst32i64 8 API calls 17709 7ff60f1947b1 17707->17709 17710 7ff60f196098 memcpy_s 11 API calls 17708->17710 17709->17669 17709->17670 17711 7ff60f194dc0 17710->17711 17712 7ff60f1953c8 45 API calls 17711->17712 17724->17707 17793 7ff60f1992fd 17792->17793 17797 7ff60f1861ea 17792->17797 17794 7ff60f196098 memcpy_s 11 API calls 17793->17794 17795 7ff60f199302 17794->17795 17796 7ff60f199f20 _invalid_parameter_noinfo 37 API calls 17795->17796 17796->17797 17798 7ff60f19706c 17797->17798 17799 7ff60f197075 17798->17799 17800 7ff60f19708a 17798->17800 17801 7ff60f196078 _fread_nolock 11 API calls 17799->17801 17802 7ff60f196078 _fread_nolock 11 API calls 17800->17802 17806 7ff60f197082 17800->17806 17849 7ff60f19547c 17848->17849 17850 7ff60f1954a2 17849->17850 17853 7ff60f1954d5 17849->17853 17851 7ff60f196098 memcpy_s 11 API calls 17850->17851 17852 7ff60f1954a7 17851->17852 17854 7ff60f199f20 _invalid_parameter_noinfo 37 API calls 17852->17854 17855 7ff60f1954e8 17853->17855 17856 7ff60f1954db 17853->17856 17859 7ff60f182e39 17854->17859 17867 7ff60f19a268 17855->17867 17857 7ff60f196098 memcpy_s 11 API calls 17856->17857 17857->17859 17859->16384 17880 7ff60f19f818 EnterCriticalSection 17867->17880 18228 7ff60f197adc 18227->18228 18231 7ff60f1975b8 18228->18231 18230 7ff60f197af5 18230->16394 18232 7ff60f197602 18231->18232 18233 7ff60f1975d3 18231->18233 18241 7ff60f19439c EnterCriticalSection 18232->18241 18235 7ff60f199e54 _invalid_parameter_noinfo 37 API calls 18233->18235 18237 7ff60f1975f3 18235->18237 18237->18230 18243 7ff60f18e413 18242->18243 18244 7ff60f18e441 18242->18244 18245 7ff60f199e54 _invalid_parameter_noinfo 37 API calls 18243->18245 18247 7ff60f18e433 18244->18247 18252 7ff60f19439c EnterCriticalSection 18244->18252 18245->18247 18247->16398 18254 7ff60f1812f8 18253->18254 18255 7ff60f1812c6 18253->18255 18256 7ff60f18eca4 73 API calls 18254->18256 18257 7ff60f182de0 120 API calls 18255->18257 18258 7ff60f18130a 18256->18258 18259 7ff60f1812d6 18257->18259 18260 7ff60f18132f 18258->18260 18261 7ff60f18130e 18258->18261 18259->18254 18262 7ff60f1812de 18259->18262 18267 7ff60f181364 18260->18267 18268 7ff60f181344 18260->18268 18263 7ff60f181c10 86 API calls 18261->18263 18264 7ff60f181c50 86 API calls 18262->18264 18265 7ff60f181325 18263->18265 18266 7ff60f1812ee 18264->18266 18265->16409 18266->16409 18270 7ff60f18137e 18267->18270 18276 7ff60f181395 18267->18276 18269 7ff60f181c10 86 API calls 18268->18269 18275 7ff60f18135f __vcrt_freefls 18269->18275 18271 7ff60f181050 94 API calls 18270->18271 18271->18275 18272 7ff60f18e96c _fread_nolock 53 API calls 18272->18276 18273 7ff60f181421 18273->16409 18274 7ff60f18e61c 74 API calls 18274->18273 18275->18273 18275->18274 18276->18272 18276->18275 18277 7ff60f1813de 18276->18277 18278 7ff60f181c10 86 API calls 18277->18278 18278->18275 18280 7ff60f181b30 49 API calls 18279->18280 18281 7ff60f182e90 18280->18281 18281->16411 18281->18281 18283 7ff60f1816ab 18282->18283 18284 7ff60f181669 18282->18284 18283->16414 18284->18283 18285 7ff60f181c50 86 API calls 18284->18285 18286 7ff60f1816bf 18285->18286 18286->16414 18288 7ff60f186dc0 88 API calls 18287->18288 18289 7ff60f186337 LoadLibraryExW 18288->18289 18290 7ff60f186354 __vcrt_freefls 18289->18290 18290->16435 18292 7ff60f1850fc GetProcAddress 18291->18292 18293 7ff60f1850d9 18291->18293 18292->18293 18294 7ff60f185121 GetProcAddress 18292->18294 18295 7ff60f181cb0 86 API calls 18293->18295 18294->18293 18296 7ff60f185146 GetProcAddress 18294->18296 18297 7ff60f1850ec 18295->18297 18296->18293 18298 7ff60f18516e GetProcAddress 18296->18298 18297->16442 18298->18293 18299 7ff60f185196 GetProcAddress 18298->18299 18299->18293 18351 7ff60f183ad0 18350->18351 18352 7ff60f181b30 49 API calls 18351->18352 18353 7ff60f183b02 18352->18353 18354 7ff60f183b2b 18353->18354 18355 7ff60f183b0b 18353->18355 18357 7ff60f183b82 18354->18357 18359 7ff60f182e60 49 API calls 18354->18359 18356 7ff60f181c50 86 API calls 18355->18356 18361 7ff60f183b21 18356->18361 18358 7ff60f182e60 49 API calls 18357->18358 18360 7ff60f183b9b 18358->18360 18362 7ff60f183b4c 18359->18362 18363 7ff60f183bb9 18360->18363 18367 7ff60f181c50 86 API calls 18360->18367 18365 7ff60f18a110 _wfindfirst32i64 8 API calls 18361->18365 18364 7ff60f183b6a 18362->18364 18369 7ff60f181c50 86 API calls 18362->18369 18368 7ff60f186320 89 API calls 18363->18368 18421 7ff60f182d70 18364->18421 18366 7ff60f1822de 18365->18366 18366->16456 18378 7ff60f183e40 18366->18378 18367->18363 18371 7ff60f183bc6 18368->18371 18369->18364 18373 7ff60f183bed 18371->18373 18374 7ff60f183bcb 18371->18374 18427 7ff60f182f20 GetProcAddress 18373->18427 18376 7ff60f181cb0 86 API calls 18374->18376 18375 7ff60f186320 89 API calls 18375->18357 18376->18361 18379 7ff60f185af0 92 API calls 18378->18379 18382 7ff60f183e55 18379->18382 18380 7ff60f183e70 18381 7ff60f186dc0 88 API calls 18380->18381 18384 7ff60f183eb4 18381->18384 18382->18380 18383 7ff60f181c50 86 API calls 18382->18383 18383->18380 18385 7ff60f183eb9 18384->18385 18386 7ff60f183ed0 18384->18386 18387 7ff60f181c50 86 API calls 18385->18387 18389 7ff60f186dc0 88 API calls 18386->18389 18388 7ff60f183ec5 18387->18388 18388->16458 18390 7ff60f183f05 18389->18390 18392 7ff60f181b30 49 API calls 18390->18392 18404 7ff60f183f0a __vcrt_freefls 18390->18404 18391 7ff60f181c50 86 API calls 18393 7ff60f1840b1 18391->18393 18394 7ff60f183f87 18392->18394 18393->16458 18395 7ff60f183fb3 18394->18395 18396 7ff60f183f8e 18394->18396 18398 7ff60f186dc0 88 API calls 18395->18398 18397 7ff60f181c50 86 API calls 18396->18397 18399 7ff60f183fa3 18397->18399 18400 7ff60f183fcc 18398->18400 18399->16458 18400->18404 18404->18391 18405 7ff60f18409a 18404->18405 18405->16458 18407 7ff60f183857 18406->18407 18407->18407 18408 7ff60f183880 18407->18408 18415 7ff60f183897 __vcrt_freefls 18407->18415 18409 7ff60f181c50 86 API calls 18408->18409 18411 7ff60f18397b 18412 7ff60f1812b0 120 API calls 18412->18415 18413 7ff60f181780 86 API calls 18413->18415 18414 7ff60f181c50 86 API calls 18414->18415 18415->18411 18415->18412 18415->18413 18415->18414 18422 7ff60f182d7a 18421->18422 18423 7ff60f186dc0 88 API calls 18422->18423 18424 7ff60f182da2 18423->18424 18425 7ff60f18a110 _wfindfirst32i64 8 API calls 18424->18425 18426 7ff60f182dca 18425->18426 18426->18357 18426->18375 18428 7ff60f182f6b GetProcAddress 18427->18428 18429 7ff60f182f48 18427->18429 18428->18429 18430 7ff60f182f90 GetProcAddress 18428->18430 18432 7ff60f181cb0 86 API calls 18429->18432 18430->18429 18431 7ff60f182fb5 GetProcAddress 18430->18431 18431->18429 18433 7ff60f182fdd GetProcAddress 18431->18433 18434 7ff60f182f5b 18432->18434 18433->18429 18435 7ff60f183005 GetProcAddress 18433->18435 18434->18361 18435->18429 18436 7ff60f18302d GetProcAddress 18435->18436 18437 7ff60f183049 18436->18437 18438 7ff60f183055 GetProcAddress 18436->18438 18437->18438 18439 7ff60f18307d GetProcAddress 18438->18439 18440 7ff60f183071 18438->18440 18441 7ff60f183099 18439->18441 18440->18439 18442 7ff60f1830ad GetProcAddress 18441->18442 18443 7ff60f1830d5 GetProcAddress 18441->18443 18442->18443 15048 7ff60f189700 15049 7ff60f18972e 15048->15049 15050 7ff60f189715 15048->15050 15050->15049 15053 7ff60f19cc3c 15050->15053 15054 7ff60f19cc87 15053->15054 15055 7ff60f19cc4b memcpy_s 15053->15055 15063 7ff60f196098 15054->15063 15055->15054 15057 7ff60f19cc6e HeapAlloc 15055->15057 15060 7ff60f1a2740 15055->15060 15057->15055 15058 7ff60f18978c 15057->15058 15066 7ff60f1a2780 15060->15066 15072 7ff60f19a908 GetLastError 15063->15072 15065 7ff60f1960a1 15065->15058 15071 7ff60f19f818 EnterCriticalSection 15066->15071 15073 7ff60f19a949 FlsSetValue 15072->15073 15076 7ff60f19a92c 15072->15076 15074 7ff60f19a939 SetLastError 15073->15074 15075 7ff60f19a95b 15073->15075 15074->15065 15089 7ff60f19dec8 15075->15089 15076->15073 15076->15074 15080 7ff60f19a988 FlsSetValue 15083 7ff60f19a994 FlsSetValue 15080->15083 15084 7ff60f19a9a6 15080->15084 15081 7ff60f19a978 FlsSetValue 15082 7ff60f19a981 15081->15082 15096 7ff60f199f88 15082->15096 15083->15082 15102 7ff60f19a534 15084->15102 15094 7ff60f19ded9 memcpy_s 15089->15094 15090 7ff60f19df2a 15093 7ff60f196098 memcpy_s 10 API calls 15090->15093 15091 7ff60f19df0e HeapAlloc 15092 7ff60f19a96a 15091->15092 15091->15094 15092->15080 15092->15081 15093->15092 15094->15090 15094->15091 15095 7ff60f1a2740 memcpy_s 2 API calls 15094->15095 15095->15094 15097 7ff60f199fbc 15096->15097 15098 7ff60f199f8d RtlFreeHeap 15096->15098 15097->15074 15098->15097 15099 7ff60f199fa8 GetLastError 15098->15099 15100 7ff60f199fb5 __free_lconv_mon 15099->15100 15101 7ff60f196098 memcpy_s 9 API calls 15100->15101 15101->15097 15107 7ff60f19a40c 15102->15107 15119 7ff60f19f818 EnterCriticalSection 15107->15119 18990 7ff60f1a0880 19001 7ff60f1a67f4 18990->19001 19002 7ff60f1a6801 19001->19002 19003 7ff60f199f88 __free_lconv_mon 11 API calls 19002->19003 19004 7ff60f1a681d 19002->19004 19003->19002 19005 7ff60f199f88 __free_lconv_mon 11 API calls 19004->19005 19006 7ff60f1a0889 19004->19006 19005->19004 19007 7ff60f19f818 EnterCriticalSection 19006->19007 19506 7ff60f19a610 19507 7ff60f19a615 19506->19507 19511 7ff60f19a62a 19506->19511 19512 7ff60f19a630 19507->19512 19513 7ff60f19a672 19512->19513 19516 7ff60f19a67a 19512->19516 19514 7ff60f199f88 __free_lconv_mon 11 API calls 19513->19514 19514->19516 19515 7ff60f199f88 __free_lconv_mon 11 API calls 19517 7ff60f19a687 19515->19517 19516->19515 19518 7ff60f199f88 __free_lconv_mon 11 API calls 19517->19518 19519 7ff60f19a694 19518->19519 19520 7ff60f199f88 __free_lconv_mon 11 API calls 19519->19520 19521 7ff60f19a6a1 19520->19521 19522 7ff60f199f88 __free_lconv_mon 11 API calls 19521->19522 19523 7ff60f19a6ae 19522->19523 19524 7ff60f199f88 __free_lconv_mon 11 API calls 19523->19524 19525 7ff60f19a6bb 19524->19525 19526 7ff60f199f88 __free_lconv_mon 11 API calls 19525->19526 19527 7ff60f19a6c8 19526->19527 19528 7ff60f199f88 __free_lconv_mon 11 API calls 19527->19528 19529 7ff60f19a6d5 19528->19529 19530 7ff60f199f88 __free_lconv_mon 11 API calls 19529->19530 19531 7ff60f19a6e5 19530->19531 19532 7ff60f199f88 __free_lconv_mon 11 API calls 19531->19532 19533 7ff60f19a6f5 19532->19533 19538 7ff60f19a4d4 19533->19538 19552 7ff60f19f818 EnterCriticalSection 19538->19552 15121 7ff60f196888 15122 7ff60f1968ef 15121->15122 15123 7ff60f1968b6 15121->15123 15122->15123 15125 7ff60f1968f4 FindFirstFileExW 15122->15125 15124 7ff60f196098 memcpy_s 11 API calls 15123->15124 15126 7ff60f1968bb 15124->15126 15127 7ff60f196916 GetLastError 15125->15127 15128 7ff60f19695d 15125->15128 15201 7ff60f199f20 15126->15201 15131 7ff60f19694d 15127->15131 15135 7ff60f196921 15127->15135 15181 7ff60f196af8 15128->15181 15133 7ff60f196098 memcpy_s 11 API calls 15131->15133 15132 7ff60f1968c6 15203 7ff60f18a110 15132->15203 15133->15132 15135->15131 15137 7ff60f19692b 15135->15137 15138 7ff60f19693d 15135->15138 15136 7ff60f196af8 _wfindfirst32i64 10 API calls 15141 7ff60f196983 15136->15141 15137->15131 15142 7ff60f196930 15137->15142 15139 7ff60f196098 memcpy_s 11 API calls 15138->15139 15139->15132 15145 7ff60f196af8 _wfindfirst32i64 10 API calls 15141->15145 15143 7ff60f196098 memcpy_s 11 API calls 15142->15143 15143->15132 15146 7ff60f196991 15145->15146 15188 7ff60f19f9b4 15146->15188 15149 7ff60f1969bb 15197 7ff60f199f40 IsProcessorFeaturePresent 15149->15197 15182 7ff60f196b10 15181->15182 15183 7ff60f196b16 FileTimeToSystemTime 15181->15183 15182->15183 15185 7ff60f196b3b 15182->15185 15184 7ff60f196b25 SystemTimeToTzSpecificLocalTime 15183->15184 15183->15185 15184->15185 15186 7ff60f18a110 _wfindfirst32i64 8 API calls 15185->15186 15187 7ff60f196975 15186->15187 15187->15136 15189 7ff60f19f9cb 15188->15189 15190 7ff60f19f9c1 15188->15190 15191 7ff60f196098 memcpy_s 11 API calls 15189->15191 15190->15189 15194 7ff60f19f9e7 15190->15194 15196 7ff60f19f9d3 15191->15196 15192 7ff60f199f20 _invalid_parameter_noinfo 37 API calls 15193 7ff60f1969af 15192->15193 15193->15132 15193->15149 15194->15193 15195 7ff60f196098 memcpy_s 11 API calls 15194->15195 15195->15196 15196->15192 15198 7ff60f199f53 15197->15198 15212 7ff60f199c54 15198->15212 15220 7ff60f199db8 15201->15220 15205 7ff60f18a119 15203->15205 15204 7ff60f18a124 15205->15204 15206 7ff60f18a1d0 IsProcessorFeaturePresent 15205->15206 15207 7ff60f18a1e8 15206->15207 15258 7ff60f18a3c4 RtlCaptureContext 15207->15258 15213 7ff60f199c8e _wfindfirst32i64 memcpy_s 15212->15213 15214 7ff60f199cb6 RtlCaptureContext RtlLookupFunctionEntry 15213->15214 15215 7ff60f199cf0 RtlVirtualUnwind 15214->15215 15216 7ff60f199d26 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 15214->15216 15215->15216 15217 7ff60f199d78 _wfindfirst32i64 15216->15217 15218 7ff60f18a110 _wfindfirst32i64 8 API calls 15217->15218 15219 7ff60f199d97 GetCurrentProcess TerminateProcess 15218->15219 15221 7ff60f199de3 15220->15221 15224 7ff60f199e54 15221->15224 15223 7ff60f199e0a 15232 7ff60f199b9c 15224->15232 15228 7ff60f199e8f 15228->15223 15230 7ff60f199f40 _wfindfirst32i64 17 API calls 15231 7ff60f199f1f 15230->15231 15233 7ff60f199bf3 15232->15233 15234 7ff60f199bb8 GetLastError 15232->15234 15233->15228 15238 7ff60f199c08 15233->15238 15235 7ff60f199bc8 15234->15235 15241 7ff60f19a9d0 15235->15241 15239 7ff60f199c24 GetLastError SetLastError 15238->15239 15240 7ff60f199c3c 15238->15240 15239->15240 15240->15228 15240->15230 15242 7ff60f19a9ef FlsGetValue 15241->15242 15243 7ff60f19aa0a FlsSetValue 15241->15243 15244 7ff60f19aa04 15242->15244 15246 7ff60f199be3 SetLastError 15242->15246 15245 7ff60f19aa17 15243->15245 15243->15246 15244->15243 15247 7ff60f19dec8 memcpy_s 11 API calls 15245->15247 15246->15233 15248 7ff60f19aa26 15247->15248 15249 7ff60f19aa44 FlsSetValue 15248->15249 15250 7ff60f19aa34 FlsSetValue 15248->15250 15252 7ff60f19aa50 FlsSetValue 15249->15252 15253 7ff60f19aa62 15249->15253 15251 7ff60f19aa3d 15250->15251 15254 7ff60f199f88 __free_lconv_mon 11 API calls 15251->15254 15252->15251 15255 7ff60f19a534 memcpy_s 11 API calls 15253->15255 15254->15246 15256 7ff60f19aa6a 15255->15256 15257 7ff60f199f88 __free_lconv_mon 11 API calls 15256->15257 15257->15246 15259 7ff60f18a3de RtlLookupFunctionEntry 15258->15259 15260 7ff60f18a3f4 RtlVirtualUnwind 15259->15260 15261 7ff60f18a1fb 15259->15261 15260->15259 15260->15261 15262 7ff60f18a190 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 15261->15262 19016 7ff60f1a9587 19017 7ff60f1a9597 19016->19017 19020 7ff60f1943a8 LeaveCriticalSection 19017->19020 19578 7ff60f1a970d 19581 7ff60f1943a8 LeaveCriticalSection 19578->19581

                                    Executed Functions

                                    Function 00007FF60F1A4EB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334timeCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 135 7ff60f1a4eb0-7ff60f1a4eeb call 7ff60f1a4838 call 7ff60f1a4840 call 7ff60f1a48a8 142 7ff60f1a4ef1-7ff60f1a4efc call 7ff60f1a4848 135->142 143 7ff60f1a5115-7ff60f1a5161 call 7ff60f199f40 call 7ff60f1a4838 call 7ff60f1a4840 call 7ff60f1a48a8 135->143 142->143 148 7ff60f1a4f02-7ff60f1a4f0c 142->148 170 7ff60f1a529f-7ff60f1a530d call 7ff60f199f40 call 7ff60f1a0748 143->170 171 7ff60f1a5167-7ff60f1a5172 call 7ff60f1a4848 143->171 151 7ff60f1a4f2e-7ff60f1a4f32 148->151 152 7ff60f1a4f0e-7ff60f1a4f11 148->152 155 7ff60f1a4f35-7ff60f1a4f3d 151->155 154 7ff60f1a4f14-7ff60f1a4f1f 152->154 157 7ff60f1a4f21-7ff60f1a4f28 154->157 158 7ff60f1a4f2a-7ff60f1a4f2c 154->158 155->155 159 7ff60f1a4f3f-7ff60f1a4f52 call 7ff60f19cc3c 155->159 157->154 157->158 158->151 161 7ff60f1a4f5b-7ff60f1a4f69 158->161 165 7ff60f1a4f54-7ff60f1a4f56 call 7ff60f199f88 159->165 166 7ff60f1a4f6a-7ff60f1a4f76 call 7ff60f199f88 159->166 165->161 176 7ff60f1a4f7d-7ff60f1a4f85 166->176 188 7ff60f1a530f-7ff60f1a5316 170->188 189 7ff60f1a531b-7ff60f1a531e 170->189 171->170 180 7ff60f1a5178-7ff60f1a5183 call 7ff60f1a4878 171->180 176->176 179 7ff60f1a4f87-7ff60f1a4f98 call 7ff60f19f9b4 176->179 179->143 190 7ff60f1a4f9e-7ff60f1a4ff4 call 7ff60f18b890 * 4 call 7ff60f1a4dcc 179->190 180->170 187 7ff60f1a5189-7ff60f1a51ac call 7ff60f199f88 GetTimeZoneInformation 180->187 202 7ff60f1a51b2-7ff60f1a51d3 187->202 203 7ff60f1a5274-7ff60f1a529e call 7ff60f1a4830 call 7ff60f1a4820 call 7ff60f1a4828 187->203 192 7ff60f1a53ab-7ff60f1a53ae 188->192 193 7ff60f1a5320 189->193 194 7ff60f1a5355-7ff60f1a5368 call 7ff60f19cc3c 189->194 247 7ff60f1a4ff6-7ff60f1a4ffa 190->247 198 7ff60f1a5323 192->198 199 7ff60f1a53b4-7ff60f1a53bc call 7ff60f1a4eb0 192->199 193->198 208 7ff60f1a5373-7ff60f1a538e call 7ff60f1a0748 194->208 209 7ff60f1a536a 194->209 204 7ff60f1a5328-7ff60f1a5354 call 7ff60f199f88 call 7ff60f18a110 198->204 205 7ff60f1a5323 call 7ff60f1a512c 198->205 199->204 210 7ff60f1a51de-7ff60f1a51e5 202->210 211 7ff60f1a51d5-7ff60f1a51db 202->211 205->204 232 7ff60f1a5390-7ff60f1a5393 208->232 233 7ff60f1a5395-7ff60f1a53a7 call 7ff60f199f88 208->233 216 7ff60f1a536c-7ff60f1a5371 call 7ff60f199f88 209->216 218 7ff60f1a51e7-7ff60f1a51ef 210->218 219 7ff60f1a51f9 210->219 211->210 216->193 218->219 227 7ff60f1a51f1-7ff60f1a51f7 218->227 224 7ff60f1a51fb-7ff60f1a526f call 7ff60f18b890 * 4 call 7ff60f1a1d0c call 7ff60f1a53c4 * 2 219->224 224->203 227->224 232->216 233->192 249 7ff60f1a5000-7ff60f1a5004 247->249 250 7ff60f1a4ffc 247->250 249->247 253 7ff60f1a5006-7ff60f1a502b call 7ff60f1a7cf4 249->253 250->249 259 7ff60f1a502e-7ff60f1a5032 253->259 261 7ff60f1a5041-7ff60f1a5045 259->261 262 7ff60f1a5034-7ff60f1a503f 259->262 261->259 262->261 264 7ff60f1a5047-7ff60f1a504b 262->264 266 7ff60f1a504d-7ff60f1a5075 call 7ff60f1a7cf4 264->266 267 7ff60f1a50cc-7ff60f1a50d0 264->267 275 7ff60f1a5093-7ff60f1a5097 266->275 276 7ff60f1a5077 266->276 269 7ff60f1a50d2-7ff60f1a50d4 267->269 270 7ff60f1a50d7-7ff60f1a50e4 267->270 269->270 272 7ff60f1a50ff-7ff60f1a510e call 7ff60f1a4830 call 7ff60f1a4820 270->272 273 7ff60f1a50e6-7ff60f1a50fc call 7ff60f1a4dcc 270->273 272->143 273->272 275->267 281 7ff60f1a5099-7ff60f1a50b7 call 7ff60f1a7cf4 275->281 279 7ff60f1a507a-7ff60f1a5081 276->279 279->275 282 7ff60f1a5083-7ff60f1a5091 279->282 287 7ff60f1a50c3-7ff60f1a50ca 281->287 282->275 282->279 287->267 288 7ff60f1a50b9-7ff60f1a50bd 287->288 288->267 289 7ff60f1a50bf 288->289 289->287
                                    APIs
                                    • _get_daylight.LIBCMT ref: 00007FF60F1A4EF5
                                      • Part of subcall function 00007FF60F1A4848: _invalid_parameter_noinfo.LIBCMT ref: 00007FF60F1A485C
                                      • Part of subcall function 00007FF60F199F88: RtlFreeHeap.NTDLL(?,?,?,00007FF60F1A1ED2,?,?,?,00007FF60F1A1F0F,?,?,00000000,00007FF60F1A23D5,?,?,00000000,00007FF60F1A2307), ref: 00007FF60F199F9E
                                      • Part of subcall function 00007FF60F199F88: GetLastError.KERNEL32(?,?,?,00007FF60F1A1ED2,?,?,?,00007FF60F1A1F0F,?,?,00000000,00007FF60F1A23D5,?,?,00000000,00007FF60F1A2307), ref: 00007FF60F199FA8
                                      • Part of subcall function 00007FF60F199F40: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF60F199F1F,?,?,?,?,?,00007FF60F191A50), ref: 00007FF60F199F49
                                      • Part of subcall function 00007FF60F199F40: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF60F199F1F,?,?,?,?,?,00007FF60F191A50), ref: 00007FF60F199F6E
                                    • _get_daylight.LIBCMT ref: 00007FF60F1A4EE4
                                      • Part of subcall function 00007FF60F1A48A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF60F1A48BC
                                    • _get_daylight.LIBCMT ref: 00007FF60F1A515A
                                    • _get_daylight.LIBCMT ref: 00007FF60F1A516B
                                    • _get_daylight.LIBCMT ref: 00007FF60F1A517C
                                    • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF60F1A53BC), ref: 00007FF60F1A51A3
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
                                    • String ID: Eastern Standard Time$Eastern Summer Time
                                    • API String ID: 4070488512-239921721
                                    • Opcode ID: 094aa0b8d65919baa3d0772ff3767fd2675aa8a4e03dc9ca21af0ffdcdca806f
                                    • Instruction ID: 71f9883345d5a7dadbebb44a9de875d8e6fdd5626254157d273668a8dbe434fd
                                    • Opcode Fuzzy Hash: 094aa0b8d65919baa3d0772ff3767fd2675aa8a4e03dc9ca21af0ffdcdca806f
                                    • Instruction Fuzzy Hash: 02D1E136E1C24286EB24DF26E9401B977A1FF84B84F6440BAEA1DC7695DF7CE445C780
                                    Function 00007FF60F1858E0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 141COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    APIs
                                    • GetTempPathW.KERNEL32(?,?,00000000,?,?,00007FF60F1858AD), ref: 00007FF60F185977
                                    • GetCurrentProcessId.KERNEL32(?,?,00000000,?,?,00007FF60F1858AD), ref: 00007FF60F18597D
                                      • Part of subcall function 00007FF60F185AF0: GetEnvironmentVariableW.KERNEL32(00007FF60F182817,?,?,?,?,?,?), ref: 00007FF60F185B2A
                                      • Part of subcall function 00007FF60F185AF0: ExpandEnvironmentStringsW.KERNEL32(?,?,?,?,?,?), ref: 00007FF60F185B47
                                      • Part of subcall function 00007FF60F196828: _invalid_parameter_noinfo.LIBCMT ref: 00007FF60F196841
                                    • SetEnvironmentVariableW.KERNEL32(?,?,00000000,?,?,00007FF60F1858AD), ref: 00007FF60F185A31
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: Environment$Variable$CurrentExpandPathProcessStringsTemp_invalid_parameter_noinfo
                                    • String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
                                    • API String ID: 1556224225-1116378104
                                    • Opcode ID: 01a46a9a65a39ff1d58c313a88a664a0d39fffa59273ca9ce6eb9bf9af19ca8f
                                    • Instruction ID: b6a80f263035e1aabbf44c7e267f313bd9b1f703b08a67b40e5412dddb1ac5e1
                                    • Opcode Fuzzy Hash: 01a46a9a65a39ff1d58c313a88a664a0d39fffa59273ca9ce6eb9bf9af19ca8f
                                    • Instruction Fuzzy Hash: 5E517D35B0D65341FE14A722AA912BA5382DF85BD0F6844B1ED0ECB797EF6DE4078340
                                    Function 00007FF60F1A5DFC Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 389 7ff60f1a5dfc-7ff60f1a5e6f call 7ff60f1a5b30 392 7ff60f1a5e71-7ff60f1a5e7a call 7ff60f196078 389->392 393 7ff60f1a5e89-7ff60f1a5e93 call 7ff60f196e70 389->393 398 7ff60f1a5e7d-7ff60f1a5e84 call 7ff60f196098 392->398 399 7ff60f1a5eae-7ff60f1a5f17 CreateFileW 393->399 400 7ff60f1a5e95-7ff60f1a5eac call 7ff60f196078 call 7ff60f196098 393->400 416 7ff60f1a61ca-7ff60f1a61ea 398->416 401 7ff60f1a5f94-7ff60f1a5f9f GetFileType 399->401 402 7ff60f1a5f19-7ff60f1a5f1f 399->402 400->398 409 7ff60f1a5fa1-7ff60f1a5fdc GetLastError call 7ff60f19600c CloseHandle 401->409 410 7ff60f1a5ff2-7ff60f1a5ff9 401->410 406 7ff60f1a5f61-7ff60f1a5f8f GetLastError call 7ff60f19600c 402->406 407 7ff60f1a5f21-7ff60f1a5f25 402->407 406->398 407->406 414 7ff60f1a5f27-7ff60f1a5f5f CreateFileW 407->414 409->398 424 7ff60f1a5fe2-7ff60f1a5fed call 7ff60f196098 409->424 412 7ff60f1a6001-7ff60f1a6004 410->412 413 7ff60f1a5ffb-7ff60f1a5fff 410->413 419 7ff60f1a600a-7ff60f1a605f call 7ff60f196d88 412->419 420 7ff60f1a6006 412->420 413->419 414->401 414->406 428 7ff60f1a607e-7ff60f1a60af call 7ff60f1a58b0 419->428 429 7ff60f1a6061-7ff60f1a606d call 7ff60f1a5d38 419->429 420->419 424->398 434 7ff60f1a60b1-7ff60f1a60b3 428->434 435 7ff60f1a60b5-7ff60f1a60f7 428->435 429->428 436 7ff60f1a606f 429->436 437 7ff60f1a6071-7ff60f1a6079 call 7ff60f19a100 434->437 438 7ff60f1a6119-7ff60f1a6124 435->438 439 7ff60f1a60f9-7ff60f1a60fd 435->439 436->437 437->416 441 7ff60f1a61c8 438->441 442 7ff60f1a612a-7ff60f1a612e 438->442 439->438 440 7ff60f1a60ff-7ff60f1a6114 439->440 440->438 441->416 442->441 444 7ff60f1a6134-7ff60f1a6179 CloseHandle CreateFileW 442->444 446 7ff60f1a61ae-7ff60f1a61c3 444->446 447 7ff60f1a617b-7ff60f1a61a9 GetLastError call 7ff60f19600c call 7ff60f196fb0 444->447 446->441 447->446
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                    • String ID:
                                    • API String ID: 1617910340-0
                                    • Opcode ID: f4a66a793454549687445e322010bf0c8aa55a7819c853dce57e356f604717af
                                    • Instruction ID: 5f932c4cff2a71ab5cbf149a0b3041c08d873aefc0bebfa0fc401b973b4db778
                                    • Opcode Fuzzy Hash: f4a66a793454549687445e322010bf0c8aa55a7819c853dce57e356f604717af
                                    • Instruction Fuzzy Hash: ACC1DF32B2CA4285EB10CFA4C5906BC37B1FB49BA8B250275DE2E97795DF39E459C340
                                    Function 00007FF60F1A512C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 794 7ff60f1a512c-7ff60f1a5161 call 7ff60f1a4838 call 7ff60f1a4840 call 7ff60f1a48a8 801 7ff60f1a529f-7ff60f1a530d call 7ff60f199f40 call 7ff60f1a0748 794->801 802 7ff60f1a5167-7ff60f1a5172 call 7ff60f1a4848 794->802 814 7ff60f1a530f-7ff60f1a5316 801->814 815 7ff60f1a531b-7ff60f1a531e 801->815 802->801 808 7ff60f1a5178-7ff60f1a5183 call 7ff60f1a4878 802->808 808->801 813 7ff60f1a5189-7ff60f1a51ac call 7ff60f199f88 GetTimeZoneInformation 808->813 825 7ff60f1a51b2-7ff60f1a51d3 813->825 826 7ff60f1a5274-7ff60f1a529e call 7ff60f1a4830 call 7ff60f1a4820 call 7ff60f1a4828 813->826 817 7ff60f1a53ab-7ff60f1a53ae 814->817 818 7ff60f1a5320 815->818 819 7ff60f1a5355-7ff60f1a5368 call 7ff60f19cc3c 815->819 822 7ff60f1a5323 817->822 823 7ff60f1a53b4-7ff60f1a53bc call 7ff60f1a4eb0 817->823 818->822 830 7ff60f1a5373-7ff60f1a538e call 7ff60f1a0748 819->830 831 7ff60f1a536a 819->831 827 7ff60f1a5328-7ff60f1a5354 call 7ff60f199f88 call 7ff60f18a110 822->827 828 7ff60f1a5323 call 7ff60f1a512c 822->828 823->827 832 7ff60f1a51de-7ff60f1a51e5 825->832 833 7ff60f1a51d5-7ff60f1a51db 825->833 828->827 850 7ff60f1a5390-7ff60f1a5393 830->850 851 7ff60f1a5395-7ff60f1a53a7 call 7ff60f199f88 830->851 837 7ff60f1a536c-7ff60f1a5371 call 7ff60f199f88 831->837 839 7ff60f1a51e7-7ff60f1a51ef 832->839 840 7ff60f1a51f9 832->840 833->832 837->818 839->840 846 7ff60f1a51f1-7ff60f1a51f7 839->846 843 7ff60f1a51fb-7ff60f1a526f call 7ff60f18b890 * 4 call 7ff60f1a1d0c call 7ff60f1a53c4 * 2 840->843 843->826 846->843 850->837 851->817
                                    APIs
                                    • _get_daylight.LIBCMT ref: 00007FF60F1A515A
                                      • Part of subcall function 00007FF60F1A48A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF60F1A48BC
                                    • _get_daylight.LIBCMT ref: 00007FF60F1A516B
                                      • Part of subcall function 00007FF60F1A4848: _invalid_parameter_noinfo.LIBCMT ref: 00007FF60F1A485C
                                    • _get_daylight.LIBCMT ref: 00007FF60F1A517C
                                      • Part of subcall function 00007FF60F1A4878: _invalid_parameter_noinfo.LIBCMT ref: 00007FF60F1A488C
                                      • Part of subcall function 00007FF60F199F88: RtlFreeHeap.NTDLL(?,?,?,00007FF60F1A1ED2,?,?,?,00007FF60F1A1F0F,?,?,00000000,00007FF60F1A23D5,?,?,00000000,00007FF60F1A2307), ref: 00007FF60F199F9E
                                      • Part of subcall function 00007FF60F199F88: GetLastError.KERNEL32(?,?,?,00007FF60F1A1ED2,?,?,?,00007FF60F1A1F0F,?,?,00000000,00007FF60F1A23D5,?,?,00000000,00007FF60F1A2307), ref: 00007FF60F199FA8
                                    • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF60F1A53BC), ref: 00007FF60F1A51A3
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
                                    • String ID: Eastern Standard Time$Eastern Summer Time
                                    • API String ID: 3458911817-239921721
                                    • Opcode ID: fd078edb7ea8857bbddca5cb379a768099f63ff1987e7d86fa41c3a02db3c977
                                    • Instruction ID: 38acbc584f84989e3b486e51793f3560ec2cf114bad2888dcdcd7cf93dea3b5f
                                    • Opcode Fuzzy Hash: fd078edb7ea8857bbddca5cb379a768099f63ff1987e7d86fa41c3a02db3c977
                                    • Instruction Fuzzy Hash: 93518D32A1C64286E710DF22E9801B9B7A1FF88784F6455BAEA5DC37A6DF3CE405C740
                                    Function 00007FF60F19FA98 Relevance: 2.0, APIs: 1, Instructions: 461COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: CurrentFeaturePresentProcessProcessor
                                    • String ID:
                                    • API String ID: 1010374628-0
                                    • Opcode ID: 77b634f070b5d0425022c69dd6fb332ff82a5336b27442bcf42cac2e1250e46a
                                    • Instruction ID: 7e53ff6ecd3cbfd1af9299ab40440a090efb049edc2e4b2cd3d688b408d75800
                                    • Opcode Fuzzy Hash: 77b634f070b5d0425022c69dd6fb332ff82a5336b27442bcf42cac2e1250e46a
                                    • Instruction Fuzzy Hash: 6102B132F0D69350FA659B21A4112796780EF45BA0FB849B9DD6EC77D2DF3DE8028380
                                    Function 00007FF60F1817B0 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 144COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: _fread_nolock$_invalid_parameter_noinfo
                                    • String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
                                    • API String ID: 3405171723-4158440160
                                    • Opcode ID: 84763b409ffefaeafb6b7d4785f14c57d5f11daf0945f8cc1ec6fe977dfebcdb
                                    • Instruction ID: f42261027cbde2e239c9811e22ddacf527898e21de98bad1e435bd04293adab8
                                    • Opcode Fuzzy Hash: 84763b409ffefaeafb6b7d4785f14c57d5f11daf0945f8cc1ec6fe977dfebcdb
                                    • Instruction Fuzzy Hash: 16514D72A0DA4296EB54CF29D55127833A0FF48B88B608576DA0DD7399DFBCE446C740
                                    Function 00007FF60F181440 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 133COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 53 7ff60f181440-7ff60f181457 call 7ff60f185880 56 7ff60f181459-7ff60f181461 53->56 57 7ff60f181462-7ff60f181485 call 7ff60f185ba0 53->57 60 7ff60f1814a7-7ff60f1814ad 57->60 61 7ff60f181487-7ff60f1814a2 call 7ff60f181c10 57->61 63 7ff60f1814e0-7ff60f1814f4 call 7ff60f18eca4 60->63 64 7ff60f1814af-7ff60f1814ba call 7ff60f182de0 60->64 69 7ff60f181635-7ff60f181647 61->69 71 7ff60f181516-7ff60f18151a 63->71 72 7ff60f1814f6-7ff60f181511 call 7ff60f181c10 63->72 70 7ff60f1814bf-7ff60f1814c5 64->70 70->63 73 7ff60f1814c7-7ff60f1814db call 7ff60f181c50 70->73 76 7ff60f18151c-7ff60f181528 call 7ff60f181050 71->76 77 7ff60f181534-7ff60f181554 call 7ff60f19415c 71->77 82 7ff60f181617-7ff60f18161d 72->82 73->82 83 7ff60f18152d-7ff60f18152f 76->83 87 7ff60f181556-7ff60f181570 call 7ff60f181c10 77->87 88 7ff60f181575-7ff60f18157b 77->88 85 7ff60f18162b-7ff60f18162e call 7ff60f18e61c 82->85 86 7ff60f18161f call 7ff60f18e61c 82->86 83->82 98 7ff60f181633 85->98 97 7ff60f181624 86->97 99 7ff60f18160d-7ff60f181612 87->99 90 7ff60f181605-7ff60f181608 call 7ff60f194148 88->90 91 7ff60f181581-7ff60f181586 88->91 90->99 96 7ff60f181590-7ff60f1815b2 call 7ff60f18e96c 91->96 102 7ff60f1815e5-7ff60f1815ec 96->102 103 7ff60f1815b4-7ff60f1815cc call 7ff60f18f0ac 96->103 97->85 98->69 99->82 105 7ff60f1815f3-7ff60f1815fb call 7ff60f181c10 102->105 109 7ff60f1815d5-7ff60f1815e3 103->109 110 7ff60f1815ce-7ff60f1815d1 103->110 111 7ff60f181600 105->111 109->105 110->96 112 7ff60f1815d3 110->112 111->90 112->111
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                    • API String ID: 0-666925554
                                    • Opcode ID: 1263ffe4802157f0869bfd811baca3ed4696afe89ae68e0db96ca42f9cae616b
                                    • Instruction ID: e8c53f8531a64fcc7aaddd73785cd38b7b2b881a8f562bd7cd1eceaea1725a01
                                    • Opcode Fuzzy Hash: 1263ffe4802157f0869bfd811baca3ed4696afe89ae68e0db96ca42f9cae616b
                                    • Instruction Fuzzy Hash: C951AC72B0CA42A1EA109B51E6006B963A0EF45BE4F7445B1DE1DD76A2EFBCE14BC700
                                    Function 00007FF60F186A70 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 91COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    APIs
                                    • GetCurrentProcess.KERNEL32(00000000,00007FF60F1859BA,?,?,00000000,?,?,00007FF60F1858AD), ref: 00007FF60F186AB0
                                    • OpenProcessToken.ADVAPI32(?,?,00000000,?,?,00007FF60F1858AD), ref: 00007FF60F186AC1
                                    • GetTokenInformation.KERNELBASE(?,?,00000000,?,?,00007FF60F1858AD), ref: 00007FF60F186AE3
                                    • GetLastError.KERNEL32(?,?,00000000,?,?,00007FF60F1858AD), ref: 00007FF60F186AED
                                    • GetTokenInformation.KERNELBASE(?,?,00000000,?,?,00007FF60F1858AD), ref: 00007FF60F186B2A
                                    • ConvertSidToStringSidW.ADVAPI32 ref: 00007FF60F186B3C
                                    • CloseHandle.KERNEL32(?,?,00000000,?,?,00007FF60F1858AD), ref: 00007FF60F186B54
                                    • LocalFree.KERNEL32(?,?,00000000,?,?,00007FF60F1858AD), ref: 00007FF60F186B86
                                    • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FF60F186BAD
                                    • CreateDirectoryW.KERNELBASE(?,?,00000000,?,?,00007FF60F1858AD), ref: 00007FF60F186BBE
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen
                                    • String ID: D:(A;;FA;;;%s)$S-1-3-4
                                    • API String ID: 4998090-2855260032
                                    • Opcode ID: 91f206f193b68330ebd28d0cb2e5982b23392e5c7638bf7621f932f987ca90f9
                                    • Instruction ID: e1b53a99506eeb90e7e010dbdb0e5760a018c5812519856529bef1fb56d2967c
                                    • Opcode Fuzzy Hash: 91f206f193b68330ebd28d0cb2e5982b23392e5c7638bf7621f932f987ca90f9
                                    • Instruction Fuzzy Hash: BC419031A0CA8382EB509F20E5447BA73A1FF84794F600271EA5E87AD5DF7DE449CB40
                                    Function 00007FF60F186140 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90processsynchronizationCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
                                    • String ID: CreateProcessW$Error creating child process!
                                    • API String ID: 2895956056-3524285272
                                    • Opcode ID: f9329e10ecf7cd9add790cd54d80bd1613acac9f8f0a608475d9c7ff608cd0f3
                                    • Instruction ID: 9948c28bd22c2bb9993f022334a39d6d29824fd06712a99c8bba43fe0a775271
                                    • Opcode Fuzzy Hash: f9329e10ecf7cd9add790cd54d80bd1613acac9f8f0a608475d9c7ff608cd0f3
                                    • Instruction Fuzzy Hash: 60414731A0CB8281DA20DB64F5552AAB3A1FF95360F600379E6AD87BD5DF7CD059CB40
                                    Function 00007FF60F181000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 274COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 452 7ff60f181000-7ff60f1827b6 call 7ff60f18e3f0 call 7ff60f18e3e8 call 7ff60f1867d0 call 7ff60f18a140 call 7ff60f194320 call 7ff60f194f8c call 7ff60f181af0 468 7ff60f1827bc-7ff60f1827cb call 7ff60f182cd0 452->468 469 7ff60f1828ca 452->469 468->469 474 7ff60f1827d1-7ff60f1827e4 call 7ff60f182ba0 468->474 471 7ff60f1828cf-7ff60f1828ef call 7ff60f18a110 469->471 474->469 478 7ff60f1827ea-7ff60f1827fd call 7ff60f182c50 474->478 478->469 481 7ff60f182803-7ff60f18282a call 7ff60f185af0 478->481 484 7ff60f18286c-7ff60f182894 call 7ff60f186100 call 7ff60f1819d0 481->484 485 7ff60f18282c-7ff60f18283b call 7ff60f185af0 481->485 495 7ff60f18297d-7ff60f18298e 484->495 496 7ff60f18289a-7ff60f1828b0 call 7ff60f1819d0 484->496 485->484 490 7ff60f18283d-7ff60f182843 485->490 492 7ff60f182845-7ff60f18284d 490->492 493 7ff60f18284f-7ff60f182869 call 7ff60f194148 call 7ff60f186100 490->493 492->493 493->484 500 7ff60f1829a3-7ff60f1829bb call 7ff60f186dc0 495->500 501 7ff60f182990-7ff60f18299a call 7ff60f1824a0 495->501 506 7ff60f1828b2-7ff60f1828c5 call 7ff60f181c50 496->506 507 7ff60f1828f0-7ff60f1828f3 496->507 511 7ff60f1829bd-7ff60f1829c9 call 7ff60f181c50 500->511 512 7ff60f1829ce-7ff60f1829d5 SetDllDirectoryW 500->512 515 7ff60f18299c 501->515 516 7ff60f1829db-7ff60f1829e8 call 7ff60f184fa0 501->516 506->469 507->495 514 7ff60f1828f9-7ff60f182910 call 7ff60f182de0 507->514 511->469 512->516 525 7ff60f182917-7ff60f182943 call 7ff60f186370 514->525 526 7ff60f182912-7ff60f182915 514->526 515->500 523 7ff60f1829ea-7ff60f1829fa call 7ff60f184c40 516->523 524 7ff60f182a36-7ff60f182a3b call 7ff60f184f20 516->524 523->524 540 7ff60f1829fc-7ff60f182a0b call 7ff60f1847a0 523->540 533 7ff60f182a40-7ff60f182a43 524->533 535 7ff60f18296d-7ff60f18297b 525->535 536 7ff60f182945-7ff60f18294d call 7ff60f18e61c 525->536 529 7ff60f182952-7ff60f182968 call 7ff60f181c50 526->529 529->469 538 7ff60f182a49-7ff60f182a56 533->538 539 7ff60f182af6-7ff60f182b05 call 7ff60f182330 533->539 535->501 536->529 542 7ff60f182a60-7ff60f182a6a 538->542 539->469 554 7ff60f182b0b-7ff60f182b42 call 7ff60f186090 call 7ff60f185af0 call 7ff60f184530 539->554 552 7ff60f182a0d-7ff60f182a19 call 7ff60f184720 540->552 553 7ff60f182a2c-7ff60f182a31 call 7ff60f1849f0 540->553 546 7ff60f182a6c-7ff60f182a71 542->546 547 7ff60f182a73-7ff60f182a75 542->547 546->542 546->547 550 7ff60f182a77-7ff60f182a9a call 7ff60f181b30 547->550 551 7ff60f182ac1-7ff60f182af1 call 7ff60f182490 call 7ff60f1822d0 call 7ff60f182480 call 7ff60f1849f0 call 7ff60f184f20 547->551 550->469 567 7ff60f182aa0-7ff60f182aab 550->567 551->471 552->553 564 7ff60f182a1b-7ff60f182a2a call 7ff60f184df0 552->564 553->524 554->469 577 7ff60f182b48-7ff60f182b7d call 7ff60f182490 call 7ff60f186140 call 7ff60f1849f0 call 7ff60f184f20 554->577 564->533 568 7ff60f182ab0-7ff60f182abf 567->568 568->551 568->568 590 7ff60f182b87-7ff60f182b91 call 7ff60f181ab0 577->590 591 7ff60f182b7f-7ff60f182b82 call 7ff60f185e00 577->591 590->471 591->590
                                    APIs
                                      • Part of subcall function 00007FF60F182CD0: GetModuleFileNameW.KERNEL32(?,00007FF60F1827C9,?,?,?,?,?,?), ref: 00007FF60F182D01
                                    • SetDllDirectoryW.KERNEL32 ref: 00007FF60F1829D5
                                      • Part of subcall function 00007FF60F185AF0: GetEnvironmentVariableW.KERNEL32(00007FF60F182817,?,?,?,?,?,?), ref: 00007FF60F185B2A
                                      • Part of subcall function 00007FF60F185AF0: ExpandEnvironmentStringsW.KERNEL32(?,?,?,?,?,?), ref: 00007FF60F185B47
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
                                    • String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
                                    • API String ID: 2344891160-3602715111
                                    • Opcode ID: 6a28c33e22898031b80fb512893e07fd0cd100b3512c2502032b978ee29aa1aa
                                    • Instruction ID: d514e8a73e6732a384ea52bb459570d788e1907a290763abd1bfb07f5b3b84b9
                                    • Opcode Fuzzy Hash: 6a28c33e22898031b80fb512893e07fd0cd100b3512c2502032b978ee29aa1aa
                                    • Instruction Fuzzy Hash: 9BC18031A1C6C351EA65AB22DA602FD6391FF44784F6040B2EA4DC769AEFBCE507C740
                                    Function 00007FF60F181050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 595 7ff60f181050-7ff60f1810ab call 7ff60f1899a0 598 7ff60f1810ad-7ff60f1810d2 call 7ff60f181c50 595->598 599 7ff60f1810d3-7ff60f1810eb call 7ff60f19415c 595->599 604 7ff60f1810ed-7ff60f181104 call 7ff60f181c10 599->604 605 7ff60f181109-7ff60f181119 call 7ff60f19415c 599->605 612 7ff60f18126c-7ff60f1812a0 call 7ff60f189680 call 7ff60f194148 * 2 604->612 610 7ff60f18111b-7ff60f181132 call 7ff60f181c10 605->610 611 7ff60f181137-7ff60f181147 605->611 610->612 614 7ff60f181150-7ff60f181175 call 7ff60f18e96c 611->614 621 7ff60f18117b-7ff60f181185 call 7ff60f18e6e0 614->621 622 7ff60f18125e 614->622 621->622 629 7ff60f18118b-7ff60f181197 621->629 624 7ff60f181264 622->624 624->612 630 7ff60f1811a0-7ff60f1811c8 call 7ff60f187df0 629->630 633 7ff60f1811ca-7ff60f1811cd 630->633 634 7ff60f181241-7ff60f18125c call 7ff60f181c50 630->634 635 7ff60f18123c 633->635 636 7ff60f1811cf-7ff60f1811d9 633->636 634->624 635->634 638 7ff60f1811db-7ff60f1811e8 call 7ff60f18f0ac 636->638 639 7ff60f181203-7ff60f181206 636->639 644 7ff60f1811ed-7ff60f1811f0 638->644 642 7ff60f181219-7ff60f18121e 639->642 643 7ff60f181208-7ff60f181216 call 7ff60f18aed0 639->643 642->630 646 7ff60f181220-7ff60f181223 642->646 643->642 647 7ff60f1811f2-7ff60f1811fc call 7ff60f18e6e0 644->647 648 7ff60f1811fe-7ff60f181201 644->648 650 7ff60f181237-7ff60f18123a 646->650 651 7ff60f181225-7ff60f181228 646->651 647->642 647->648 648->634 650->624 651->634 653 7ff60f18122a-7ff60f181232 651->653 653->614
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: 1.2.13$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                    • API String ID: 0-1655038675
                                    • Opcode ID: 1a8844bf67229d1899e895c5de39fde8d842d05050e1b2cb9d7974bf2e428afa
                                    • Instruction ID: 46cb2c0f7f1e4877a94a88e9b6ae2abcc918e7b4cbe2e38dc3143f0962339492
                                    • Opcode Fuzzy Hash: 1a8844bf67229d1899e895c5de39fde8d842d05050e1b2cb9d7974bf2e428afa
                                    • Instruction Fuzzy Hash: 9151CA32A0C68291EA609B51E5403BA6391FB85B94F7441B6EE4ED7785EF7CE407C700
                                    Function 00007FF60F19DF40 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                    Download Yara Rule

                                    Control-flow Graph

                                    APIs
                                    • FreeLibrary.KERNEL32(?,00000000,?,00007FF60F19E2DA,?,?,-00000018,00007FF60F19A393,?,?,?,00007FF60F19A28A,?,?,?,00007FF60F1954F2), ref: 00007FF60F19E0BC
                                    • GetProcAddress.KERNEL32(?,00000000,?,00007FF60F19E2DA,?,?,-00000018,00007FF60F19A393,?,?,?,00007FF60F19A28A,?,?,?,00007FF60F1954F2), ref: 00007FF60F19E0C8
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: AddressFreeLibraryProc
                                    • String ID: api-ms-$ext-ms-
                                    • API String ID: 3013587201-537541572
                                    • Opcode ID: aad9aede478575e979b907d5906f12f078c77a7925399981a7c8c7e1570d79b3
                                    • Instruction ID: 3dd968a5d1fd01637da1673a32421abc3d1f186b9656e931eed85fb45db9a454
                                    • Opcode Fuzzy Hash: aad9aede478575e979b907d5906f12f078c77a7925399981a7c8c7e1570d79b3
                                    • Instruction Fuzzy Hash: 7D41CD31B1DA1281FA56DB16E9006792391FF48BA0F6C4579DD1DC7784EF3EE8498390
                                    Function 00007FF60F19B09C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 681 7ff60f19b09c-7ff60f19b0c2 682 7ff60f19b0c4-7ff60f19b0d8 call 7ff60f196078 call 7ff60f196098 681->682 683 7ff60f19b0dd-7ff60f19b0e1 681->683 697 7ff60f19b4ce 682->697 684 7ff60f19b4b7-7ff60f19b4c3 call 7ff60f196078 call 7ff60f196098 683->684 685 7ff60f19b0e7-7ff60f19b0ee 683->685 704 7ff60f19b4c9 call 7ff60f199f20 684->704 685->684 687 7ff60f19b0f4-7ff60f19b122 685->687 687->684 690 7ff60f19b128-7ff60f19b12f 687->690 694 7ff60f19b131-7ff60f19b143 call 7ff60f196078 call 7ff60f196098 690->694 695 7ff60f19b148-7ff60f19b14b 690->695 694->704 700 7ff60f19b151-7ff60f19b157 695->700 701 7ff60f19b4b3-7ff60f19b4b5 695->701 702 7ff60f19b4d1-7ff60f19b4e8 697->702 700->701 705 7ff60f19b15d-7ff60f19b160 700->705 701->702 704->697 705->694 708 7ff60f19b162-7ff60f19b187 705->708 710 7ff60f19b189-7ff60f19b18b 708->710 711 7ff60f19b1ba-7ff60f19b1c1 708->711 714 7ff60f19b1b2-7ff60f19b1b8 710->714 715 7ff60f19b18d-7ff60f19b194 710->715 712 7ff60f19b1c3-7ff60f19b1eb call 7ff60f19cc3c call 7ff60f199f88 * 2 711->712 713 7ff60f19b196-7ff60f19b1ad call 7ff60f196078 call 7ff60f196098 call 7ff60f199f20 711->713 741 7ff60f19b208-7ff60f19b233 call 7ff60f19b8c4 712->741 742 7ff60f19b1ed-7ff60f19b203 call 7ff60f196098 call 7ff60f196078 712->742 745 7ff60f19b340 713->745 717 7ff60f19b238-7ff60f19b24f 714->717 715->713 715->714 720 7ff60f19b251-7ff60f19b259 717->720 721 7ff60f19b2ca-7ff60f19b2d4 call 7ff60f1a2acc 717->721 720->721 725 7ff60f19b25b-7ff60f19b25d 720->725 732 7ff60f19b35e 721->732 733 7ff60f19b2da-7ff60f19b2ef 721->733 725->721 729 7ff60f19b25f-7ff60f19b275 725->729 729->721 734 7ff60f19b277-7ff60f19b283 729->734 736 7ff60f19b363-7ff60f19b383 ReadFile 732->736 733->732 738 7ff60f19b2f1-7ff60f19b303 GetConsoleMode 733->738 734->721 739 7ff60f19b285-7ff60f19b287 734->739 743 7ff60f19b389-7ff60f19b391 736->743 744 7ff60f19b47d-7ff60f19b486 GetLastError 736->744 738->732 746 7ff60f19b305-7ff60f19b30d 738->746 739->721 747 7ff60f19b289-7ff60f19b2a1 739->747 741->717 742->745 743->744 749 7ff60f19b397 743->749 752 7ff60f19b4a3-7ff60f19b4a6 744->752 753 7ff60f19b488-7ff60f19b49e call 7ff60f196098 call 7ff60f196078 744->753 754 7ff60f19b343-7ff60f19b34d call 7ff60f199f88 745->754 746->736 751 7ff60f19b30f-7ff60f19b331 ReadConsoleW 746->751 747->721 755 7ff60f19b2a3-7ff60f19b2af 747->755 760 7ff60f19b39e-7ff60f19b3b3 749->760 762 7ff60f19b333 GetLastError 751->762 763 7ff60f19b352-7ff60f19b35c 751->763 757 7ff60f19b339-7ff60f19b33b call 7ff60f19600c 752->757 758 7ff60f19b4ac-7ff60f19b4ae 752->758 753->745 754->702 755->721 756 7ff60f19b2b1-7ff60f19b2b3 755->756 756->721 766 7ff60f19b2b5-7ff60f19b2c5 756->766 757->745 758->754 760->754 768 7ff60f19b3b5-7ff60f19b3c0 760->768 762->757 763->760 766->721 773 7ff60f19b3c2-7ff60f19b3db call 7ff60f19acb4 768->773 774 7ff60f19b3e7-7ff60f19b3ef 768->774 781 7ff60f19b3e0-7ff60f19b3e2 773->781 777 7ff60f19b3f1-7ff60f19b403 774->777 778 7ff60f19b46b-7ff60f19b478 call 7ff60f19aaf4 774->778 782 7ff60f19b45e-7ff60f19b466 777->782 783 7ff60f19b405 777->783 778->781 781->754 782->754 785 7ff60f19b40a-7ff60f19b411 783->785 786 7ff60f19b413-7ff60f19b417 785->786 787 7ff60f19b44d-7ff60f19b458 785->787 788 7ff60f19b433 786->788 789 7ff60f19b419-7ff60f19b420 786->789 787->782 791 7ff60f19b439-7ff60f19b449 788->791 789->788 790 7ff60f19b422-7ff60f19b426 789->790 790->788 792 7ff60f19b428-7ff60f19b431 790->792 791->785 793 7ff60f19b44b 791->793 792->791 793->782
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: _invalid_parameter_noinfo
                                    • String ID:
                                    • API String ID: 3215553584-0
                                    • Opcode ID: f51be05eff67105166a8e0974f5b8922bd2b6cae86938e82961f641d8e49780a
                                    • Instruction ID: fef5076ae37b6f82f7bcfceba3c113fc18604a0db98855059d893e79d8f2cdd4
                                    • Opcode Fuzzy Hash: f51be05eff67105166a8e0974f5b8922bd2b6cae86938e82961f641d8e49780a
                                    • Instruction Fuzzy Hash: 1CC10332A0C68791E760CB55A4402BD3BA1EFD1B80F7901B9DA4E83791CF7DEA498380
                                    Function 00007FF60F19C5A0 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 871 7ff60f19c5a0-7ff60f19c5c5 872 7ff60f19c893 871->872 873 7ff60f19c5cb-7ff60f19c5ce 871->873 874 7ff60f19c895-7ff60f19c8a5 872->874 875 7ff60f19c5d0-7ff60f19c602 call 7ff60f199e54 873->875 876 7ff60f19c607-7ff60f19c633 873->876 875->874 878 7ff60f19c63e-7ff60f19c644 876->878 879 7ff60f19c635-7ff60f19c63c 876->879 881 7ff60f19c654-7ff60f19c669 call 7ff60f1a2acc 878->881 882 7ff60f19c646-7ff60f19c64f call 7ff60f19b960 878->882 879->875 879->878 886 7ff60f19c66f-7ff60f19c678 881->886 887 7ff60f19c783-7ff60f19c78c 881->887 882->881 886->887 890 7ff60f19c67e-7ff60f19c682 886->890 888 7ff60f19c78e-7ff60f19c794 887->888 889 7ff60f19c7e0-7ff60f19c805 WriteFile 887->889 891 7ff60f19c796-7ff60f19c799 888->891 892 7ff60f19c7cc-7ff60f19c7de call 7ff60f19c058 888->892 895 7ff60f19c810 889->895 896 7ff60f19c807-7ff60f19c80d GetLastError 889->896 893 7ff60f19c693-7ff60f19c69e 890->893 894 7ff60f19c684-7ff60f19c68c call 7ff60f193840 890->894 897 7ff60f19c7b8-7ff60f19c7ca call 7ff60f19c278 891->897 898 7ff60f19c79b-7ff60f19c79e 891->898 919 7ff60f19c770-7ff60f19c777 892->919 900 7ff60f19c6af-7ff60f19c6c4 GetConsoleMode 893->900 901 7ff60f19c6a0-7ff60f19c6a9 893->901 894->893 903 7ff60f19c813 895->903 896->895 897->919 905 7ff60f19c824-7ff60f19c82e 898->905 906 7ff60f19c7a4-7ff60f19c7b6 call 7ff60f19c15c 898->906 909 7ff60f19c6ca-7ff60f19c6d0 900->909 910 7ff60f19c77c 900->910 901->887 901->900 904 7ff60f19c818 903->904 912 7ff60f19c81d 904->912 913 7ff60f19c830-7ff60f19c835 905->913 914 7ff60f19c88c-7ff60f19c891 905->914 906->919 917 7ff60f19c6d6-7ff60f19c6d9 909->917 918 7ff60f19c759-7ff60f19c76b call 7ff60f19bbe0 909->918 910->887 912->905 920 7ff60f19c863-7ff60f19c86d 913->920 921 7ff60f19c837-7ff60f19c83a 913->921 914->874 923 7ff60f19c6e4-7ff60f19c6f2 917->923 924 7ff60f19c6db-7ff60f19c6de 917->924 918->919 919->904 928 7ff60f19c86f-7ff60f19c872 920->928 929 7ff60f19c874-7ff60f19c883 920->929 926 7ff60f19c853-7ff60f19c85e call 7ff60f196054 921->926 927 7ff60f19c83c-7ff60f19c84b 921->927 930 7ff60f19c750-7ff60f19c754 923->930 931 7ff60f19c6f4 923->931 924->912 924->923 926->920 927->926 928->872 928->929 929->914 930->903 933 7ff60f19c6f8-7ff60f19c70f call 7ff60f1a2b98 931->933 937 7ff60f19c711-7ff60f19c71d 933->937 938 7ff60f19c747-7ff60f19c74d GetLastError 933->938 939 7ff60f19c71f-7ff60f19c731 call 7ff60f1a2b98 937->939 940 7ff60f19c73c-7ff60f19c743 937->940 938->930 939->938 944 7ff60f19c733-7ff60f19c73a 939->944 940->930 942 7ff60f19c745 940->942 942->933 944->940
                                    APIs
                                    • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF60F19C58B), ref: 00007FF60F19C6BC
                                    • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF60F19C58B), ref: 00007FF60F19C747
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: ConsoleErrorLastMode
                                    • String ID:
                                    • API String ID: 953036326-0
                                    • Opcode ID: 47869f412bece76eb023dbb07aa2cba14259a80e0a96d05eb24eea3b46299af7
                                    • Instruction ID: e6cf51d1f73916b1d2bd5f9a27f395b6c02d36593e39364bcea37bd998ad2c3b
                                    • Opcode Fuzzy Hash: 47869f412bece76eb023dbb07aa2cba14259a80e0a96d05eb24eea3b46299af7
                                    • Instruction Fuzzy Hash: C5919032E1C69385F7548F6594802BD3BA1FB44B88F6441B9DE8EA7A94DF38E446C7C0
                                    Function 00007FF60F19E96C Relevance: 6.2, APIs: 4, Instructions: 162COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: _get_daylight$_isindst
                                    • String ID:
                                    • API String ID: 4170891091-0
                                    • Opcode ID: 7c116d52e869d70fe36170fafcd4453455d7a89aa2c255f713b58b82420c40e6
                                    • Instruction ID: d0d0c75ca962e43ef561abd9aadbb6c4e3103ee5c2a1a727d67b03ad8f060a9a
                                    • Opcode Fuzzy Hash: 7c116d52e869d70fe36170fafcd4453455d7a89aa2c255f713b58b82420c40e6
                                    • Instruction Fuzzy Hash: 6651E272F0C2128AFB28DF64D9556BC27A1FB50368F640179EE1F93AE5DF38A4068740
                                    Function 00007FF60F1946F8 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                    • String ID:
                                    • API String ID: 1279662727-0
                                    • Opcode ID: 2e14a9a22f8bbc959da1ddaf4bea7386fc9969426b98b87380e1d1a6b88a1f24
                                    • Instruction ID: 315dcb31d9b0e207c685762dca199ca53a690e22a81eab77dc2f0040f365addf
                                    • Opcode Fuzzy Hash: 2e14a9a22f8bbc959da1ddaf4bea7386fc9969426b98b87380e1d1a6b88a1f24
                                    • Instruction Fuzzy Hash: 4A41BE32E2C78283E754CB61955037973A0FF957A4F209374EA9C83AD6DF7CA5A18780
                                    Function 00007FF60F18A52C Relevance: 4.6, APIs: 3, Instructions: 102COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
                                    • String ID:
                                    • API String ID: 3058843127-0
                                    • Opcode ID: 1be6874be7b06f60d2a206459abee2dcc30803262f01e71d3cdcfcaefe82dc60
                                    • Instruction ID: 46300659b5f5946a15bf2d62f387cebea70d76213ce8a798b1f538a9d432566f
                                    • Opcode Fuzzy Hash: 1be6874be7b06f60d2a206459abee2dcc30803262f01e71d3cdcfcaefe82dc60
                                    • Instruction Fuzzy Hash: B2315C31E0D64393FA54AB2496113B92391EF86B80FB444B6EA0DC72D7DFADE846C740
                                    Function 00007FF60F1989F8 Relevance: 4.5, APIs: 3, Instructions: 14COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: Process$CurrentExitTerminate
                                    • String ID:
                                    • API String ID: 1703294689-0
                                    • Opcode ID: cdaea237e1b592d6c154aaf0f90f60ef9ca2b577adbaa54e82ff2db6f3b91dce
                                    • Instruction ID: e53f0898531aebb5c1cf29d2bc0bc7b919155556059eff832c733de132859ace
                                    • Opcode Fuzzy Hash: cdaea237e1b592d6c154aaf0f90f60ef9ca2b577adbaa54e82ff2db6f3b91dce
                                    • Instruction Fuzzy Hash: 62D09230B1D603C6EA182B7058951792391EF8A761F6028B8C84FC6397CF7DA89D8280
                                    Function 00007FF60F18E70C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: _invalid_parameter_noinfo
                                    • String ID:
                                    • API String ID: 3215553584-0
                                    • Opcode ID: 91f838de0bf1c0634cfb639a0c406c35748c40ae1573d712d08faa75350ec251
                                    • Instruction ID: 2c9de7b3d986d9c0b87a5270586f15a673ab2e5f4a268f5954d2b71e8dea2f59
                                    • Opcode Fuzzy Hash: 91f838de0bf1c0634cfb639a0c406c35748c40ae1573d712d08faa75350ec251
                                    • Instruction Fuzzy Hash: 6C51E731F0D68246FB689AA6960067A6791FF85BA4F284674ED7C837C5CFBCE4028740
                                    Function 00007FF60F19BA58 Relevance: 3.1, APIs: 2, Instructions: 71COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: FileHandleType
                                    • String ID:
                                    • API String ID: 3000768030-0
                                    • Opcode ID: ea0bf9139acf7e29816fcd0aba872ae9fa759e19ef548db38860721d431a1d9c
                                    • Instruction ID: 4693968223535430b2a283139e4ba2af16fb3d9f81fc360c706a9ca5afbf5bf3
                                    • Opcode Fuzzy Hash: ea0bf9139acf7e29816fcd0aba872ae9fa759e19ef548db38860721d431a1d9c
                                    • Instruction Fuzzy Hash: ED317E32A1DB4682EB64CB15A5801782750FB85BB0B780379DB6F873E4CF38E5A1D380
                                    Function 00007FF60F19B774 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF60F19B760,00000000,?,?,?,00007FF60F181023,00007FF60F19B869), ref: 00007FF60F19B7C0
                                    • GetLastError.KERNEL32(?,?,?,?,?,00007FF60F19B760,00000000,?,?,?,00007FF60F181023,00007FF60F19B869), ref: 00007FF60F19B7CA
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: ErrorFileLastPointer
                                    • String ID:
                                    • API String ID: 2976181284-0
                                    • Opcode ID: 3ffa62e109f94fb18d3b2cbff054a6c81447e1b6aec8cf58aa39285ecb5c62cf
                                    • Instruction ID: 09801d6c33929af24e1aa1a426e59469eb24ec4e748aedba8f3f1a52d4671cf0
                                    • Opcode Fuzzy Hash: 3ffa62e109f94fb18d3b2cbff054a6c81447e1b6aec8cf58aa39285ecb5c62cf
                                    • Instruction Fuzzy Hash: 9211C172A1CA8281DA50CB26B8040A96761EB84BF4F684371EE7D8B7E9CF7CD1558780
                                    Function 00007FF60F196AF8 Relevance: 3.0, APIs: 2, Instructions: 35timeCOMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60F196975), ref: 00007FF60F196B1B
                                    • SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60F196975), ref: 00007FF60F196B31
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: Time$System$FileLocalSpecific
                                    • String ID:
                                    • API String ID: 1707611234-0
                                    • Opcode ID: 695a997772c6d588bd3c19a829da3cd4efb67dac24a46cf8f274d2962167cdc2
                                    • Instruction ID: 162d97ec01a81180414104c205a233445b82217b539af29d69805e37dd18edd2
                                    • Opcode Fuzzy Hash: 695a997772c6d588bd3c19a829da3cd4efb67dac24a46cf8f274d2962167cdc2
                                    • Instruction Fuzzy Hash: AC01C032A0C651C2E7648F14E40223AB7B1FB81B61F740276F6AE819D8EF3DD014DB60
                                    Function 00007FF60F199F88 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • RtlFreeHeap.NTDLL(?,?,?,00007FF60F1A1ED2,?,?,?,00007FF60F1A1F0F,?,?,00000000,00007FF60F1A23D5,?,?,00000000,00007FF60F1A2307), ref: 00007FF60F199F9E
                                    • GetLastError.KERNEL32(?,?,?,00007FF60F1A1ED2,?,?,?,00007FF60F1A1F0F,?,?,00000000,00007FF60F1A23D5,?,?,00000000,00007FF60F1A2307), ref: 00007FF60F199FA8
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: ErrorFreeHeapLast
                                    • String ID:
                                    • API String ID: 485612231-0
                                    • Opcode ID: 635cad2e0ff3992951b7a77c4f2b8b42bf407885737c95784d501ba83ef464ff
                                    • Instruction ID: ab1c5f32bb03510e9b88d194f7d4b77667116bde9bbfa34941363ad4ea2977d5
                                    • Opcode Fuzzy Hash: 635cad2e0ff3992951b7a77c4f2b8b42bf407885737c95784d501ba83ef464ff
                                    • Instruction Fuzzy Hash: 24E08C70F0D20382FF18ABB2A8850786391DF84740B6948B8C80DD6291EF2CA89D82A0
                                    Function 00007FF60F196860 Relevance: 3.0, APIs: 2, Instructions: 12COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: DirectoryErrorLastRemove
                                    • String ID:
                                    • API String ID: 377330604-0
                                    • Opcode ID: 6ee4c4c1d826b64487a110c2ae4246bf529d87c63a5704ba62e6a74145362de3
                                    • Instruction ID: 254fa130e6180d945dcfa2825c1c9c7b183863bec4b9c8e265bf25316b38eeee
                                    • Opcode Fuzzy Hash: 6ee4c4c1d826b64487a110c2ae4246bf529d87c63a5704ba62e6a74145362de3
                                    • Instruction Fuzzy Hash: 46D0C930F1C603C1E65827B228450791390EF44724F7006B4C029C12D0EF2DA49D9162
                                    Function 00007FF60F1970E4 Relevance: 3.0, APIs: 2, Instructions: 12fileCOMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: DeleteErrorFileLast
                                    • String ID:
                                    • API String ID: 2018770650-0
                                    • Opcode ID: e62d151a604f4e0a1f97514f12a36258322d99d4e44f7b0e6aef129f7c091d96
                                    • Instruction ID: 4fb7aaebbc0b9fcccd1857049e4c606e2aeed09c07cfcff7083ab3772433ab9b
                                    • Opcode Fuzzy Hash: e62d151a604f4e0a1f97514f12a36258322d99d4e44f7b0e6aef129f7c091d96
                                    • Instruction Fuzzy Hash: 72D01234F2C503C2EA1627B21D8907A13E0EF45720F7006F4C42EC02E0EF2EA0AD9261
                                    Function 00007FF60F19A198 Relevance: 2.6, APIs: 2, Instructions: 59COMMON
                                    Download Yara Rule
                                    APIs
                                    • CloseHandle.KERNELBASE(?,?,?,00007FF60F19A015,?,?,00000000,00007FF60F19A0CA), ref: 00007FF60F19A206
                                    • GetLastError.KERNEL32(?,?,?,00007FF60F19A015,?,?,00000000,00007FF60F19A0CA), ref: 00007FF60F19A210
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: CloseErrorHandleLast
                                    • String ID:
                                    • API String ID: 918212764-0
                                    • Opcode ID: 176045b7523cf5febd9284a5f88f2e5d392980a8c79d008abc553eacec4aafb7
                                    • Instruction ID: 25d594e04c43e51d6c9110a1b9e8066ea8bdad2a92605038be5bc247b8567d6b
                                    • Opcode Fuzzy Hash: 176045b7523cf5febd9284a5f88f2e5d392980a8c79d008abc553eacec4aafb7
                                    • Instruction Fuzzy Hash: EA219331F1C68241EA94976195A427D2392EF85BA4F3843B9DA2EC73C5DF6DE4898380
                                    Function 00007FF60F185E00 Relevance: 1.6, APIs: 1, Instructions: 141COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: ByteCharMultiWide_findclose
                                    • String ID:
                                    • API String ID: 2772937645-0
                                    • Opcode ID: f49b861ea7d3f103746b3a21f9c25844a1af0d2aa27eefd751e744e4ab09ae28
                                    • Instruction ID: 42093c23902dc87589de3a937679a5efc7e482808e0b0b06caa7b0b2688ce334
                                    • Opcode Fuzzy Hash: f49b861ea7d3f103746b3a21f9c25844a1af0d2aa27eefd751e744e4ab09ae28
                                    • Instruction Fuzzy Hash: AC718D62E1CAC581E611CB2CD6452FD7360F7A9B4CF64E321DB8C52592EF28E2DAC700
                                    Function 00007FF60F19B4EC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: _invalid_parameter_noinfo
                                    • String ID:
                                    • API String ID: 3215553584-0
                                    • Opcode ID: 57107eaa3566968eb61c891c6bf60f53c3ecf75195df01cb8ace664919c894e2
                                    • Instruction ID: 875d6026db56458103a3a3e13f6c9f62de1137ed1f086114aacec70ad56b76d1
                                    • Opcode Fuzzy Hash: 57107eaa3566968eb61c891c6bf60f53c3ecf75195df01cb8ace664919c894e2
                                    • Instruction Fuzzy Hash: 0941BE3290C24187FA24CB2AB58427973A0EB96B84F640175DA9EC36D1CF6CE603CB91
                                    Function 00007FF60F186370 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: _fread_nolock
                                    • String ID:
                                    • API String ID: 840049012-0
                                    • Opcode ID: 3c4f26b11e4462b6a968b3c82cc7ee6ac725b1771f3ecff43d43be629d0efc0e
                                    • Instruction ID: 24a8f237d244b0ce86e396d75f4f376e80cf4fc57e205123619831d652fd4065
                                    • Opcode Fuzzy Hash: 3c4f26b11e4462b6a968b3c82cc7ee6ac725b1771f3ecff43d43be629d0efc0e
                                    • Instruction Fuzzy Hash: 7A219F31B0C29646FA159B52AA043BAA751FF55BD4FA84071EE4D87786CFBCE842C300
                                    Function 00007FF60F19AF7C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: _invalid_parameter_noinfo
                                    • String ID:
                                    • API String ID: 3215553584-0
                                    • Opcode ID: 5c21e00b33c8f2b45ceb84e2d38ad87eb1f0bac44c293c41f89c92cf48f3706b
                                    • Instruction ID: 26762846c0da8f8f61ebf613db41e8509c0858d3aef8516bf71b2f64c99fed9e
                                    • Opcode Fuzzy Hash: 5c21e00b33c8f2b45ceb84e2d38ad87eb1f0bac44c293c41f89c92cf48f3706b
                                    • Instruction Fuzzy Hash: 8C31B272A1C60281F7159B25988137C3760EF80F90F7905B5EA2D833D2DFBDE84587A0
                                    Function 00007FF60F198929 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: HandleModule$AddressFreeLibraryProc
                                    • String ID:
                                    • API String ID: 3947729631-0
                                    • Opcode ID: 4364183f743529bba0b1b8a1ab3c287b648935f4c13821245ef64b361732f161
                                    • Instruction ID: f4c111a600c1e68c6cf9d4f62a37b2d7e13d5fb59a8c67d6cf6863d4026b50bf
                                    • Opcode Fuzzy Hash: 4364183f743529bba0b1b8a1ab3c287b648935f4c13821245ef64b361732f161
                                    • Instruction Fuzzy Hash: 8D21B032E0CB0289EB249F64C4502FC33B0EB86729FA41A39D76C86AC5DF38D584C781
                                    Function 00007FF60F195548 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: _invalid_parameter_noinfo
                                    • String ID:
                                    • API String ID: 3215553584-0
                                    • Opcode ID: 25f020cec256df429067bb606d051891f0f83e0bb8faa834007163ccabd97c9c
                                    • Instruction ID: 5095234b5dcf3cd085f843457fb71b1f119317e429a0a901b4a26e17ae72bbaa
                                    • Opcode Fuzzy Hash: 25f020cec256df429067bb606d051891f0f83e0bb8faa834007163ccabd97c9c
                                    • Instruction Fuzzy Hash: 5F11A232A0D64181FAA19F51E40127DA3A1FF95B80F6C44B5EA8CE7B86DF3DE4409B80
                                    Function 00007FF60F1A57EC Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: _invalid_parameter_noinfo
                                    • String ID:
                                    • API String ID: 3215553584-0
                                    • Opcode ID: ae9bd99ce62d3538fe7d29b8c80f6b7eb83d48e2b866bc47fbdf5b394f043f57
                                    • Instruction ID: aeb20b0c40d69fa6c1413b5648f7642db8ff016eb3c3343248c7612ec0b0eb36
                                    • Opcode Fuzzy Hash: ae9bd99ce62d3538fe7d29b8c80f6b7eb83d48e2b866bc47fbdf5b394f043f57
                                    • Instruction Fuzzy Hash: 94214232A1CA8187D7618F1AE44037977A1FB84B94F784274E65DC76D9DF3DD4058B40
                                    Function 00007FF60F18E98C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: _invalid_parameter_noinfo
                                    • String ID:
                                    • API String ID: 3215553584-0
                                    • Opcode ID: 298f7b2a666c55937c0a4044f00fb88544ba948c427ceaa5fd6043e577695ec0
                                    • Instruction ID: b0da4bfab6f448c846df4b51fe8c0b8a429707375e37a57e278b251b1fbc0516
                                    • Opcode Fuzzy Hash: 298f7b2a666c55937c0a4044f00fb88544ba948c427ceaa5fd6043e577695ec0
                                    • Instruction Fuzzy Hash: 4201C831A0C78241EA44DBA29A01079A791FF86FE0F6846B5EE5C93BD6CFBCD1024300
                                    Function 00007FF60F1964EC Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: _invalid_parameter_noinfo
                                    • String ID:
                                    • API String ID: 3215553584-0
                                    • Opcode ID: 89f1a6046394815f14ac2edb09e2e5d8c749716ba98b122b0912a1bcf1d4c737
                                    • Instruction ID: 0b405f2aeb36cb0343c6b480e03f7b434bdb1234c4d8eb8b5c942828c05e84b7
                                    • Opcode Fuzzy Hash: 89f1a6046394815f14ac2edb09e2e5d8c749716ba98b122b0912a1bcf1d4c737
                                    • Instruction Fuzzy Hash: ED01B171E0D68281FE64AB21E5411796390EF047E4F7845B9EA1CC2BCADF3CEC418AE1
                                    Function 00007FF60F196828 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: _invalid_parameter_noinfo
                                    • String ID:
                                    • API String ID: 3215553584-0
                                    • Opcode ID: d8ddd072cb9aeb27808c6bd09a31392064f42f391621abce153dcee42f6a1f6e
                                    • Instruction ID: 7a70e80acce349ae7d8903089d05bf14505ea2c374793b556cf444d1ea26f049
                                    • Opcode Fuzzy Hash: d8ddd072cb9aeb27808c6bd09a31392064f42f391621abce153dcee42f6a1f6e
                                    • Instruction Fuzzy Hash: 46E0ECB1E0C30642FA543AB545C227C1351DF54340F6444F9D90886387DF1E784956B1
                                    Function 00007FF60F1864A0 Relevance: 1.3, APIs: 1, Instructions: 92COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: DirectoryErrorLastRemove
                                    • String ID:
                                    • API String ID: 377330604-0
                                    • Opcode ID: efc5bac48e0eb0ffe74c9f21acabb1ae742049e90b115f0f612458e6ed3a3079
                                    • Instruction ID: c8f58cda27b1e330b2e98a9f3301654f658182713ea1ca964debc75024a28bed
                                    • Opcode Fuzzy Hash: efc5bac48e0eb0ffe74c9f21acabb1ae742049e90b115f0f612458e6ed3a3079
                                    • Instruction Fuzzy Hash: 3141A426D1C7C681EA119B24D6012FC7360FFA5784F64A272EB8D92187EF6CE5D9C700
                                    Function 00007FF60F19DEC8 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • HeapAlloc.KERNEL32(?,?,00000000,00007FF60F19AA26,?,?,?,00007FF60F199BE3,?,?,00000000,00007FF60F199E7E), ref: 00007FF60F19DF1D
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: AllocHeap
                                    • String ID:
                                    • API String ID: 4292702814-0
                                    • Opcode ID: 5680686827257c125c79c0b434b54bb6693b4c02053300f6c32a97532040a367
                                    • Instruction ID: 1a55410bf38949abb7873eff166a2fc1a8a8fd5ecbd5bf2b325a4b1535cdf27f
                                    • Opcode Fuzzy Hash: 5680686827257c125c79c0b434b54bb6693b4c02053300f6c32a97532040a367
                                    • Instruction Fuzzy Hash: 00F09074B0D20380FE585761B8523B57390DF55B80F6C54B4C94EC67D2EF2CE48682A0
                                    Function 00007FF60F19CC3C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • HeapAlloc.KERNEL32(?,?,?,00007FF60F18F1F4,?,?,?,00007FF60F190706,?,?,?,?,?,00007FF60F19276D), ref: 00007FF60F19CC7A
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: AllocHeap
                                    • String ID:
                                    • API String ID: 4292702814-0
                                    • Opcode ID: b11fc6a16e25d187a1b91613ce7ef6c78f7eee5e93957fcc5bb755ad2e5a5504
                                    • Instruction ID: 8cb9aa4621921c2db3ca6b5f7e82f4e1195e421a59003670a8e8c1afb51a7b95
                                    • Opcode Fuzzy Hash: b11fc6a16e25d187a1b91613ce7ef6c78f7eee5e93957fcc5bb755ad2e5a5504
                                    • Instruction Fuzzy Hash: FCF05870B0D24384FE2496B159512BA2780CF54BB0F280AB4E86EC52C2EF2CA44482E1

                                    Non-executed Functions

                                    Function 00007FF60F1850B0 Relevance: 164.8, APIs: 31, Strings: 63, Instructions: 263libraryloaderCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: AddressProc
                                    • String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                    • API String ID: 190572456-2208601799
                                    • Opcode ID: 77b5a64d38601d97cc6f46ef17bc262d941289dca8cc320d3ff37db910af6723
                                    • Instruction ID: 56edb9b569ef60ff2d2885b7c327a08e2a12ad883c1598bf95737ca3d3269369
                                    • Opcode Fuzzy Hash: 77b5a64d38601d97cc6f46ef17bc262d941289dca8cc320d3ff37db910af6723
                                    • Instruction Fuzzy Hash: 1FE17574A0DB0790FA59DB14AA6017833E6EF047A0BB865B5C80E86364EFBDF55DD380
                                    Function 00007FF60F1A325C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
                                    • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                    • API String ID: 808467561-2761157908
                                    • Opcode ID: 8e3f32220dbedb6b83d3a56d93bef729e8f640f2dff9788303e755a102ce7513
                                    • Instruction ID: 64168c343398d3e3e350a01d38bb939f81a390de25c79cadce0e6403f80d6c50
                                    • Opcode Fuzzy Hash: 8e3f32220dbedb6b83d3a56d93bef729e8f640f2dff9788303e755a102ce7513
                                    • Instruction Fuzzy Hash: 80B20072A1C2828BE765CE68D4407FD37E1FB54388F605175DA1ED7A88DF79AA08CB40
                                    Function 00007FF60F186680 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetLastError.KERNEL32(WideCharToMultiByte,00007FF60F181CE4,?,?,00000000,00007FF60F186914), ref: 00007FF60F1866A7
                                    • FormatMessageW.KERNEL32 ref: 00007FF60F1866D6
                                    • WideCharToMultiByte.KERNEL32 ref: 00007FF60F18672C
                                      • Part of subcall function 00007FF60F181CB0: GetLastError.KERNEL32(?,?,00000000,00007FF60F186914,?,?,?,?,?,?,?,?,?,?,?,00007FF60F181023), ref: 00007FF60F181CD7
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: ErrorLast$ByteCharFormatMessageMultiWide
                                    • String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
                                    • API String ID: 2383786077-2573406579
                                    • Opcode ID: 8af1543621e2225bbe5bffd5a6056578706e604aa2a65e437b117fd27dbfded5
                                    • Instruction ID: fc5bfe26bcd48835aa1f649b7eb3ef7b744652fd0e457ea17a425cc3bce0c49a
                                    • Opcode Fuzzy Hash: 8af1543621e2225bbe5bffd5a6056578706e604aa2a65e437b117fd27dbfded5
                                    • Instruction Fuzzy Hash: C0219231A0CA4392F7609F15E85427A33A5FF88384FA40175E54DC26A8EF7CE54EC740
                                    Function 00007FF60F18AA3C Relevance: 10.6, APIs: 7, Instructions: 72COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                    • String ID:
                                    • API String ID: 3140674995-0
                                    • Opcode ID: 1bf0d945bdc6b6fdad2122b0a21604f4ba0b1612e3b53cdd76e1331efcd592fd
                                    • Instruction ID: 4fbfc91db0aec121f2aaccf7329165033150b3cffc106c1c4819675ac8afdcc9
                                    • Opcode Fuzzy Hash: 1bf0d945bdc6b6fdad2122b0a21604f4ba0b1612e3b53cdd76e1331efcd592fd
                                    • Instruction Fuzzy Hash: C2315A7260DB819AEB608F60E8403EE73A5FB84744F54443ADA4E87B98EF7CD649C710
                                    Function 00007FF60F199C54 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                    • String ID:
                                    • API String ID: 1239891234-0
                                    • Opcode ID: 397cea56bba315d20c834348c2ab8ed400ffbe874e1da4898cc87947d67c4ad4
                                    • Instruction ID: 767de5c79f89cd19189d9ee655ad11a0493a53bf2db1fe53b91ddbdc7f077156
                                    • Opcode Fuzzy Hash: 397cea56bba315d20c834348c2ab8ed400ffbe874e1da4898cc87947d67c4ad4
                                    • Instruction Fuzzy Hash: 5F316F3661CB8196EB60CF25E8402AE73A0FB88754F64017AEA9D83B55DF3CD546CB00
                                    Function 00007FF60F1A0A44 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: FileFindFirst_invalid_parameter_noinfo
                                    • String ID:
                                    • API String ID: 2227656907-0
                                    • Opcode ID: 539584bc973764fdeb57c39dee6d85e67abf5b785ab6bac293b25a2b00955d70
                                    • Instruction ID: 8c98a9e2b552da37c2defeea9a9253f4a03cad98cb25a22aaa84203bc894819b
                                    • Opcode Fuzzy Hash: 539584bc973764fdeb57c39dee6d85e67abf5b785ab6bac293b25a2b00955d70
                                    • Instruction Fuzzy Hash: 9EB1D536B1C69281EA60DB22D5102B967D1EF48BE4F6451B5EE5E8BBC9DF3CE449C300
                                    Function 00007FF60F18A920 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                    • String ID:
                                    • API String ID: 2933794660-0
                                    • Opcode ID: be9da76585353bf4ff120931e3f5bbaf95a19439f17c7ee9af2afa7da57e9186
                                    • Instruction ID: 20bef7217564d57e6d6b8efc10b3d3bbabe09ce231f67aa7425c7cde3d1d0e13
                                    • Opcode Fuzzy Hash: be9da76585353bf4ff120931e3f5bbaf95a19439f17c7ee9af2afa7da57e9186
                                    • Instruction Fuzzy Hash: 0A111836B18B029AEB008F61E8552B833A4FB19758F540E31EA6D867A4DF7CD1998380
                                    Function 00007FF60F1A2DC0 Relevance: 4.8, APIs: 3, Instructions: 340COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: memcpy_s
                                    • String ID:
                                    • API String ID: 1502251526-0
                                    • Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                    • Instruction ID: c6ab9cbcc9c03ebe4d21f99773db32e6b41e2ffaf9188457e8828ba1b1201a6a
                                    • Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                    • Instruction Fuzzy Hash: 73C1E372B1C28687E724CF59A14476AB7E1F798B84F548139DB5A83744DF3EE809CB40
                                    Function 00007FF60F1A8BF8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: ExceptionRaise_clrfp
                                    • String ID:
                                    • API String ID: 15204871-0
                                    • Opcode ID: 7f7800ade579f0d6f16bfab74bfde48d1f128962063d5dbe27371a705b590b7f
                                    • Instruction ID: f4c5ed4d40c5b5830dfbec2e69f0672b4d3f5f20fa4f2d8e57fad858a4478893
                                    • Opcode Fuzzy Hash: 7f7800ade579f0d6f16bfab74bfde48d1f128962063d5dbe27371a705b590b7f
                                    • Instruction Fuzzy Hash: 65B15B73618B85CAEB55CF29C8463687BE0F784B58F288961DB6D837A4CF39D459C700
                                    Function 00007FF60F1869F0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: Find$CloseFileFirst
                                    • String ID:
                                    • API String ID: 2295610775-0
                                    • Opcode ID: dc40c5d753e30fe3fc1e8c3801fb870584b7f8e0a0b7135dd7118dd934c1c4bb
                                    • Instruction ID: 3394e8545f31de1483df4b41df10eefca2be9acd7299518aeea86b27b02efddd
                                    • Opcode Fuzzy Hash: dc40c5d753e30fe3fc1e8c3801fb870584b7f8e0a0b7135dd7118dd934c1c4bb
                                    • Instruction Fuzzy Hash: 05F0AF32A1C68286E7A08F60F59976A7390FB84724F105735E66D826D4DF7CE41DCA00
                                    Function 00007FF60F192A28 Relevance: 2.8, Strings: 2, Instructions: 350COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: $
                                    • API String ID: 0-227171996
                                    • Opcode ID: 7bbf33436acad36ae8a1b43dc77540a41ad4992d9fd982d144688fd018ad6b29
                                    • Instruction ID: 86b13d2eea9732ce0867a95d3597c0cf18c5e4102866ea16a1984165b21de683
                                    • Opcode Fuzzy Hash: 7bbf33436acad36ae8a1b43dc77540a41ad4992d9fd982d144688fd018ad6b29
                                    • Instruction Fuzzy Hash: FAE1AF32A0C68692EB788F29819017D33A0FF45B98F3452B5DA5E87795DF3DE852C780
                                    Function 00007FF60F19D208 Relevance: 2.6, Strings: 2, Instructions: 144COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: e+000$gfff
                                    • API String ID: 0-3030954782
                                    • Opcode ID: 533175c5a31c969ed4ab8aeb227c1284adb18f6ecb4834c3077741e0ab5839c5
                                    • Instruction ID: 71d51726bf92742dbc1b6b83ab48ab3c1d31b556d6a40188c083a22e3a4eb6aa
                                    • Opcode Fuzzy Hash: 533175c5a31c969ed4ab8aeb227c1284adb18f6ecb4834c3077741e0ab5839c5
                                    • Instruction Fuzzy Hash: 90517572B1C6C586E7248E39E900769BB91F744B90F6882B9CBA88BAC5CF7DD4048740
                                    Function 00007FF60F19CD74 Relevance: 1.5, Strings: 1, Instructions: 254COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: gfffffff
                                    • API String ID: 0-1523873471
                                    • Opcode ID: 7cb6c3f32e91a926ccbf64ab8ba01f2a38c928c6639247976dccb01524fe6e1b
                                    • Instruction ID: ade83c3bbad1318eb20cb8cedf7c55ec9c52015c18eefa9c1432ac661733027d
                                    • Opcode Fuzzy Hash: 7cb6c3f32e91a926ccbf64ab8ba01f2a38c928c6639247976dccb01524fe6e1b
                                    • Instruction Fuzzy Hash: C0A15573B0C7C686EB25CB29A0007AA7B90EB50B84F248171DE8D87781DF3EE506C781
                                    Function 00007FF60F19710C Relevance: 1.4, Strings: 1, Instructions: 177COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: _invalid_parameter_noinfo
                                    • String ID: TMP
                                    • API String ID: 3215553584-3125297090
                                    • Opcode ID: 1f7d039c64384c012ba99c8160e4e4596aee6f87cbf59d2775302b4d0e04aaa9
                                    • Instruction ID: 1272eb557cc17a804b4430bfdb2c52c30cdabe0c15f93a8d75443836f3d1be63
                                    • Opcode Fuzzy Hash: 1f7d039c64384c012ba99c8160e4e4596aee6f87cbf59d2775302b4d0e04aaa9
                                    • Instruction Fuzzy Hash: 4551A131F2C64242FA68AB66591157A53D1EF95BC4F7844B8EE0EC77D6EF3CE4064280
                                    Function 00007FF60F1A2630 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: HeapProcess
                                    • String ID:
                                    • API String ID: 54951025-0
                                    • Opcode ID: fe4f89a29164ef60706ac008de4aa1412735d6976d80202131d31ba446223f83
                                    • Instruction ID: dfdbad6ba6b101c1c575bc96ed8fe77d88fdbe81d28d667251024996d47c0421
                                    • Opcode Fuzzy Hash: fe4f89a29164ef60706ac008de4aa1412735d6976d80202131d31ba446223f83
                                    • Instruction Fuzzy Hash: 9AB09230E0BB02C2EA082B21AC8262423A4BF58B10FAA00B8C00C80320DF3C20AE9700
                                    Function 00007FF60F1921EC Relevance: .4, Instructions: 351COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: be6bd4aeaf1a32ba0a400cf215f270628cf800823f5191017f2ae2dcea54fc97
                                    • Instruction ID: aa706ad5ae9c774b7d6c59b6cfbfaa0408df24161e124f0a00e153e7b6fcd503
                                    • Opcode Fuzzy Hash: be6bd4aeaf1a32ba0a400cf215f270628cf800823f5191017f2ae2dcea54fc97
                                    • Instruction Fuzzy Hash: 0CE1C432A0C68296F7688E29C1543BC27A1EB59B54F3482B9CE0DC72D5CF3DE942C780
                                    Function 00007FF60F192624 Relevance: .3, Instructions: 327COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: c7030e3183cde293472bd1af0c19cf6b5d71ff879be136be2a1b5beee93e2b61
                                    • Instruction ID: a2b12f8150fce883ecd2723c47dbf2601b51c08bd471b3e85bda9f25dbe8bb89
                                    • Opcode Fuzzy Hash: c7030e3183cde293472bd1af0c19cf6b5d71ff879be136be2a1b5beee93e2b61
                                    • Instruction Fuzzy Hash: 0AD1E036A0C692A6EB6CCE2A855027D27A0FB16B48F3442B5CE1D976D5CF3DE845C7C0
                                    Function 00007FF60F187430 Relevance: .3, Instructions: 287COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 87de8634ded3f4e8458923233739ad96d21dd7a231352b5b7c5ed9b2526c006a
                                    • Instruction ID: 9280a80f503659c3336f4451a44ecbd407d531b1e85fd80a4f7e7e16521d92d5
                                    • Opcode Fuzzy Hash: 87de8634ded3f4e8458923233739ad96d21dd7a231352b5b7c5ed9b2526c006a
                                    • Instruction Fuzzy Hash: A0C1D4722281E08BE689EB29F45987A37D2F788309FD9403AEB87477C5CA3DE415D750
                                    Function 00007FF60F19133C Relevance: .2, Instructions: 250COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: afbdd63b75b42ad7439867ca4b24ab3856e6f83d1386856208b462784abde87f
                                    • Instruction ID: 8d7a9d9e5ef6f79624f9bc4931c46e9358e475ed14107afa06cfa763c66acb51
                                    • Opcode Fuzzy Hash: afbdd63b75b42ad7439867ca4b24ab3856e6f83d1386856208b462784abde87f
                                    • Instruction Fuzzy Hash: 7CB1A272A0C74295E7648F39C05027D3BA0EB4AF48F3941B5CA8E97399CF79E881C791
                                    Function 00007FF60F1916D4 Relevance: .2, Instructions: 241COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 9fc8fd975d7067d56c776f48e591c75802337bcef6e3071df9449d276b1abfcc
                                    • Instruction ID: 10e43dc4d246e0d2d7dfb2739451e1590b04af9d18069916c5e730047fe26876
                                    • Opcode Fuzzy Hash: 9fc8fd975d7067d56c776f48e591c75802337bcef6e3071df9449d276b1abfcc
                                    • Instruction Fuzzy Hash: 9AB16D76A0C78696EB658F2AC05027C3BA0F749F48F3441B6CA4EA7395CF39D881D785
                                    Function 00007FF60F19D888 Relevance: .2, Instructions: 198COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: fcd5d989e7635e1d0b21fa60e30f3936793c7b8db49fcf77cee77a31b8038a54
                                    • Instruction ID: 0f91a4e19523a687e44452052041ba71c9df5e5186d3125e79fcd542adae8685
                                    • Opcode Fuzzy Hash: fcd5d989e7635e1d0b21fa60e30f3936793c7b8db49fcf77cee77a31b8038a54
                                    • Instruction Fuzzy Hash: 5881C572A0C78146EB74CF29A490379B7A1FB86794F644275DADE83B99CF3CD4008B40
                                    Function 00007FF60F1A58B0 Relevance: .2, Instructions: 183COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: _invalid_parameter_noinfo
                                    • String ID:
                                    • API String ID: 3215553584-0
                                    • Opcode ID: d003bb86ff7f146e11c69d63177ddcecb431cf0828b5e126d5f920f3d1e621d2
                                    • Instruction ID: 09d7ab653ad2dfc465c831171f0ef26ecac55f4f381141374319defc8341b5f3
                                    • Opcode Fuzzy Hash: d003bb86ff7f146e11c69d63177ddcecb431cf0828b5e126d5f920f3d1e621d2
                                    • Instruction Fuzzy Hash: FE619E32F1C29246F7648A29946027D67C3EF40770F7C02B9EA5ECA6D5EF6DE8488740
                                    Function 00007FF60F190774 Relevance: .1, Instructions: 146COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: e009b45869f76b4bc0fd62373217406c0429eee7efa8b33e1f678da67ddd1256
                                    • Instruction ID: 4289565672663f69c65021dc6c410cc574d2188af7fa2ac43c3e05e876623a18
                                    • Opcode Fuzzy Hash: e009b45869f76b4bc0fd62373217406c0429eee7efa8b33e1f678da67ddd1256
                                    • Instruction Fuzzy Hash: E4516D76E1CA5186E7288B39C05423937A1EB48F68F344175CA8D97795DF3AE843CBC0
                                    Function 00007FF60F18FF54 Relevance: .1, Instructions: 146COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 9a7d583fdacf7a8c68166448a21aae8e03012e85621840fd7aae1b2904462282
                                    • Instruction ID: a373dbb811f0b7dcdb6fbf367d968ca1e3a8b64ad6063b06c2cc64d8c98027ac
                                    • Opcode Fuzzy Hash: 9a7d583fdacf7a8c68166448a21aae8e03012e85621840fd7aae1b2904462282
                                    • Instruction Fuzzy Hash: 12516037A1C65582E7288B29C14423833A0EB49F68F384171CA9D977E8DF7AE853C780
                                    Function 00007FF60F190364 Relevance: .1, Instructions: 146COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 4e0632a4a7e014686f42235b66fbebb9a54d6c0d44d943c89546efb0de6bc1d6
                                    • Instruction ID: 4d087fb50ce6512d6359118e9f749621182a4475501a6c9aae59ad2b4840ee80
                                    • Opcode Fuzzy Hash: 4e0632a4a7e014686f42235b66fbebb9a54d6c0d44d943c89546efb0de6bc1d6
                                    • Instruction Fuzzy Hash: 2A517D36A1CA5186E7248B39C04023C37A0EB58B68F345275CE8D97795CF3AED53CB80
                                    Function 00007FF60F190570 Relevance: .1, Instructions: 145COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: bbc3e59ea296ef31dc5cb467e3ef236485a99d13d7a42ba6bd49c72ea64a61b5
                                    • Instruction ID: 8b8d0c985473d0a72d4b2b39d2c93a7081ba45aa737c34f1d0e6aa9b6c278f13
                                    • Opcode Fuzzy Hash: bbc3e59ea296ef31dc5cb467e3ef236485a99d13d7a42ba6bd49c72ea64a61b5
                                    • Instruction Fuzzy Hash: B7514F76A2C65186E7648B39C05023D27A1EB89F68F358171CE8D97795CF3AEC53CB80
                                    Function 00007FF60F18FD50 Relevance: .1, Instructions: 145COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 1122cbedd3da6cae4974dcedcaf2c480ad91f4dcca857e3bd784bf5366bd6c74
                                    • Instruction ID: c359d10eecd1e7198ecf9a845b7ea04b249a2fe6e186ab614cedabbd190b0019
                                    • Opcode Fuzzy Hash: 1122cbedd3da6cae4974dcedcaf2c480ad91f4dcca857e3bd784bf5366bd6c74
                                    • Instruction Fuzzy Hash: 4E518D77A2CA5186E7248B29C24033837A0EB89B58F355171DE4D97799CFBAE843C780
                                    Function 00007FF60F190160 Relevance: .1, Instructions: 145COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: e8fed526c0ef6e22bd960d06d2221fad266d41c34a47db8c9ca14c01ed2528e2
                                    • Instruction ID: f4739d93a51faf233ddb4a6ba930da5feb833d76b3f21f1d16b2da721dc9527b
                                    • Opcode Fuzzy Hash: e8fed526c0ef6e22bd960d06d2221fad266d41c34a47db8c9ca14c01ed2528e2
                                    • Instruction Fuzzy Hash: 4F516A36A1CA5586E7648B39C04022C37A1EB9DF58F344175CE4D977A9CF3AE883C780
                                    Function 00007FF60F194FD0 Relevance: .1, Instructions: 138COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 7e13b74b0b529d91a8ac9ee6727b9f2d590474870fceb05c3e17ea5803dfc50d
                                    • Instruction ID: 98575afaecbd35597c7a60c64a7438e777592a385babd07d43598aa6d366beea
                                    • Opcode Fuzzy Hash: 7e13b74b0b529d91a8ac9ee6727b9f2d590474870fceb05c3e17ea5803dfc50d
                                    • Instruction Fuzzy Hash: 7141C072D0E64A09E997891805147B92BC2EF22BA4D3C53F4DD99B33CBCF0E258782D0
                                    Function 00007FF60F198D10 Relevance: .1, Instructions: 126COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: ErrorFreeHeapLast
                                    • String ID:
                                    • API String ID: 485612231-0
                                    • Opcode ID: 4e626db8f672c8f9a68360c7389e8f7894e58d94442387c78e1b4a483649a916
                                    • Instruction ID: bdf2677460d0b24d6a692a6f4ef238c11af693962d7b5e697f5810f55713fb69
                                    • Opcode Fuzzy Hash: 4e626db8f672c8f9a68360c7389e8f7894e58d94442387c78e1b4a483649a916
                                    • Instruction Fuzzy Hash: 8241E272B1CA5582EF48CF2AE9241A9B3A1FB48FD0B589436EE0D87B54DF3CC4468340
                                    Function 00007FF60F1966D4 Relevance: .1, Instructions: 98COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: ff02aa40d47e1f81f312e06ee07fce20c9eb6e0e746124aa9fd8eb4087d69ca8
                                    • Instruction ID: dba286650fb31452d97906c1094cc6a7482e80de51a4c1e9891ebf0d30846cfa
                                    • Opcode Fuzzy Hash: ff02aa40d47e1f81f312e06ee07fce20c9eb6e0e746124aa9fd8eb4087d69ca8
                                    • Instruction Fuzzy Hash: F731B132B0CB4282E6689F26A89012E77D5EB84BE0F244279EA5D93BD5DF3CD0124754
                                    Function 00007FF60F1A8A40 Relevance: .0, Instructions: 32COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 1f11e33a503e903f6fd17a98672f77b01e7338ee743f4d3b2c43cccbf09155b6
                                    • Instruction ID: 14e766172655b92eeb6aac74764d4134f1d74066411c7918ffc6a25076b55658
                                    • Opcode Fuzzy Hash: 1f11e33a503e903f6fd17a98672f77b01e7338ee743f4d3b2c43cccbf09155b6
                                    • Instruction Fuzzy Hash: F8F068B171C2558ADB988F6DB802629B7D0F7883C0F509579D59DC3B04DB3C90508F44
                                    Function 00007FF60F18ABE4 Relevance: .0, Instructions: 2COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: da48dd3124fb9caf3cd120bb8db444467ff7ae744a775920e6920fcf6cc11ced
                                    • Instruction ID: 2ada0a82b3138447755e30cf954d4ce65aca9b98aa99010c9b02e2478427a06f
                                    • Opcode Fuzzy Hash: da48dd3124fb9caf3cd120bb8db444467ff7ae744a775920e6920fcf6cc11ced
                                    • Instruction Fuzzy Hash: 76A0027194CC02F2E6858B00E9500303370FF55300B6101B2D04DC10A0EF7CF849C300
                                    Function 00007FF60F182F20 Relevance: 291.0, APIs: 55, Strings: 111, Instructions: 457libraryloaderCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetProcAddress.KERNEL32(?,?,00000000,00007FF60F1822DE,?,?,?,?), ref: 00007FF60F182F36
                                    • GetProcAddress.KERNEL32(?,?,00000000,00007FF60F1822DE,?,?,?,?), ref: 00007FF60F182F75
                                    • GetProcAddress.KERNEL32(?,?,00000000,00007FF60F1822DE,?,?,?,?), ref: 00007FF60F182F9A
                                    • GetProcAddress.KERNEL32(?,?,00000000,00007FF60F1822DE,?,?,?,?), ref: 00007FF60F182FBF
                                    • GetProcAddress.KERNEL32(?,?,00000000,00007FF60F1822DE,?,?,?,?), ref: 00007FF60F182FE7
                                    • GetProcAddress.KERNEL32(?,?,00000000,00007FF60F1822DE,?,?,?,?), ref: 00007FF60F18300F
                                    • GetProcAddress.KERNEL32(?,?,00000000,00007FF60F1822DE,?,?,?,?), ref: 00007FF60F183037
                                    • GetProcAddress.KERNEL32(?,?,00000000,00007FF60F1822DE,?,?,?,?), ref: 00007FF60F18305F
                                    • GetProcAddress.KERNEL32(?,?,00000000,00007FF60F1822DE,?,?,?,?), ref: 00007FF60F183087
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: AddressProc
                                    • String ID: Failed to get address for PyDict_GetItemString$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyList_New$Failed to get address for PyLong_AsLong$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PySys_AddWarnOption$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetArgvEx$Failed to get address for PySys_SetObject$Failed to get address for PySys_SetPath$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_BuildValue$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_DontWriteBytecodeFlag$Failed to get address for Py_FileSystemDefaultEncoding$Failed to get address for Py_Finalize$Failed to get address for Py_FrozenFlag$Failed to get address for Py_GetPath$Failed to get address for Py_IgnoreEnvironmentFlag$Failed to get address for Py_IncRef$Failed to get address for Py_Initialize$Failed to get address for Py_NoSiteFlag$Failed to get address for Py_NoUserSiteDirectory$Failed to get address for Py_OptimizeFlag$Failed to get address for Py_SetPath$Failed to get address for Py_SetProgramName$Failed to get address for Py_SetPythonHome$Failed to get address for Py_UTF8Mode$Failed to get address for Py_UnbufferedStdioFlag$Failed to get address for Py_VerboseFlag$GetProcAddress$PyDict_GetItemString$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyList_New$PyLong_AsLong$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyRun_SimpleStringFlags$PySys_AddWarnOption$PySys_GetObject$PySys_SetArgvEx$PySys_SetObject$PySys_SetPath$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_BuildValue$Py_DecRef$Py_DecodeLocale$Py_DontWriteBytecodeFlag$Py_FileSystemDefaultEncoding$Py_Finalize$Py_FrozenFlag$Py_GetPath$Py_IgnoreEnvironmentFlag$Py_IncRef$Py_Initialize$Py_NoSiteFlag$Py_NoUserSiteDirectory$Py_OptimizeFlag$Py_SetPath$Py_SetProgramName$Py_SetPythonHome$Py_UTF8Mode$Py_UnbufferedStdioFlag$Py_VerboseFlag
                                    • API String ID: 190572456-3109299426
                                    • Opcode ID: 3bea514fa4f08e80501ab3dc7f797134890914dfa2bea7b2bd18d9992429628c
                                    • Instruction ID: 9982d910e40495ca36de67a4fa312897301c3b6713d473bcdfcf9d326fa36cae
                                    • Opcode Fuzzy Hash: 3bea514fa4f08e80501ab3dc7f797134890914dfa2bea7b2bd18d9992429628c
                                    • Instruction Fuzzy Hash: 15428F74A0DB83D1EA5ADB08BA9017823E1EF44790FB455B5C84E863A8FFBDA55DD300
                                    Function 00007FF60F186C00 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 113COMMON
                                    Download Yara Rule
                                    APIs
                                    • MultiByteToWideChar.KERNEL32 ref: 00007FF60F186C3C
                                      • Part of subcall function 00007FF60F181CB0: GetLastError.KERNEL32(?,?,00000000,00007FF60F186914,?,?,?,?,?,?,?,?,?,?,?,00007FF60F181023), ref: 00007FF60F181CD7
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: ByteCharErrorLastMultiWide
                                    • String ID: Failed to decode wchar_t from UTF-8$Failed to encode filename as ANSI.$Failed to get ANSI buffer size.$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$WideCharToMultiByte$win32_utils_from_utf8$win32_wcs_to_mbs
                                    • API String ID: 203985260-1562484376
                                    • Opcode ID: c6af48c2a72f93560c75fce8b7fe5bee055e0ffe2315a87dca28ecb6449ed662
                                    • Instruction ID: 72d0fe624cd10abe36288dce0c02c548b7dce81a0abdc8b0bd7158c2a32827f8
                                    • Opcode Fuzzy Hash: c6af48c2a72f93560c75fce8b7fe5bee055e0ffe2315a87dca28ecb6449ed662
                                    • Instruction Fuzzy Hash: 0241A031A0CB4391E620DB21ED4007A77E2EF84BD0F644675D98ED7AA5DF7CE5068340
                                    Function 00007FF60F18F5D8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: _invalid_parameter_noinfo
                                    • String ID: f$f$p$p$f
                                    • API String ID: 3215553584-1325933183
                                    • Opcode ID: 5b8d5396a44c552a0cc4e48ad8092be8cf806d396b8c8f6251230df5f0eb9214
                                    • Instruction ID: f7cf79eb501a5e4db1a67f68daa2b81e43513232ae722cd14b5b92e5196eda61
                                    • Opcode Fuzzy Hash: 5b8d5396a44c552a0cc4e48ad8092be8cf806d396b8c8f6251230df5f0eb9214
                                    • Instruction Fuzzy Hash: BF12C536E0C28386FB20AE14E2547B97791FB80754FA44175E68AC76C8DFBCE5838B51
                                    Function 00007FF60F1812B0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 106COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                    • API String ID: 0-3659356012
                                    • Opcode ID: 0ece3a955acdc2189749ff5ff00da7320da20d9062027264bcafa9bd28b34b79
                                    • Instruction ID: 8deb96ac6ee62c849a446c0bca842eb6476daea894413d8d5ef3604aeb3d8c17
                                    • Opcode Fuzzy Hash: 0ece3a955acdc2189749ff5ff00da7320da20d9062027264bcafa9bd28b34b79
                                    • Instruction Fuzzy Hash: FC418E32B0CA4292EA24DB11E9006BA63A0FF54BD0F644472DE4D97B55EFBCE547C700
                                    Function 00007FF60F18CFA0 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                    • String ID: csm$csm$csm
                                    • API String ID: 849930591-393685449
                                    • Opcode ID: f65cca0dd748533ec0e0c8100e92ec79f40903f330e835159906267943919e52
                                    • Instruction ID: 3db6a2a12532db25356c97449c61b75496b4010a93b714c0c365fbaf16852d4e
                                    • Opcode Fuzzy Hash: f65cca0dd748533ec0e0c8100e92ec79f40903f330e835159906267943919e52
                                    • Instruction Fuzzy Hash: 36E19272A0C7418AEB20DF65E6803AD77A0FB55B98F200175EE8D97B95CF78E582C740
                                    Function 00007FF60F1867D0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 103COMMON
                                    Download Yara Rule
                                    APIs
                                    • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF60F181023), ref: 00007FF60F18686F
                                    • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF60F181023), ref: 00007FF60F1868BF
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: ByteCharMultiWide
                                    • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                    • API String ID: 626452242-27947307
                                    • Opcode ID: 842819fd0de434b72f89aea08788796a3a6fbb43ae32da6e9284d85ccd3845d2
                                    • Instruction ID: 056d153447e79b455a22ca9a1beda261d8e57c51115bb578fc54f89bc33ceb53
                                    • Opcode Fuzzy Hash: 842819fd0de434b72f89aea08788796a3a6fbb43ae32da6e9284d85ccd3845d2
                                    • Instruction Fuzzy Hash: 6D419E32A0CB8286E620CF16F95017AB7A4FB84B90F644175DE8D87BA4DF7CE456C740
                                    Function 00007FF60F186ED0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON
                                    Download Yara Rule
                                    APIs
                                    • WideCharToMultiByte.KERNEL32(00000000,00007FF60F182D35,?,?,?,?,?,?), ref: 00007FF60F186F11
                                      • Part of subcall function 00007FF60F181CB0: GetLastError.KERNEL32(?,?,00000000,00007FF60F186914,?,?,?,?,?,?,?,?,?,?,?,00007FF60F181023), ref: 00007FF60F181CD7
                                    • WideCharToMultiByte.KERNEL32(00000000,00007FF60F182D35,?,?,?,?,?,?), ref: 00007FF60F186F85
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: ByteCharMultiWide$ErrorLast
                                    • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                    • API String ID: 1717984340-27947307
                                    • Opcode ID: df947e153a4d297c551ea8f0f320faf028395d0bacfd384824c4aacdb755590f
                                    • Instruction ID: f5d04554ccd4c6ca5e50a62559cf2f543f8df4592cbb757147e4a95b16a717f5
                                    • Opcode Fuzzy Hash: df947e153a4d297c551ea8f0f320faf028395d0bacfd384824c4aacdb755590f
                                    • Instruction Fuzzy Hash: 2B217731B1CB4685EB149F26EE50079BBA1FF84B80B644175DA4DC37A4EF7CE91A8380
                                    Function 00007FF60F1993D4 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: _invalid_parameter_noinfo
                                    • String ID: f$p$p
                                    • API String ID: 3215553584-1995029353
                                    • Opcode ID: d478605e8072a694eb9a9d804e4987f1596106984b5661be3eee2fb972e34d58
                                    • Instruction ID: e6d6f4af49c87444b59393ca8431c54c7c8bf57db981966ffc994cb3baf931f9
                                    • Opcode Fuzzy Hash: d478605e8072a694eb9a9d804e4987f1596106984b5661be3eee2fb972e34d58
                                    • Instruction Fuzzy Hash: 1A12A372E0D14786FB249F15D1546BAB792FB90750FE8417DE68A876C8DF3DE8808B80
                                    Function 00007FF60F186FC0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 98COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: ByteCharMultiWide
                                    • String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                    • API String ID: 626452242-876015163
                                    • Opcode ID: c63a8705ae77710e22cb38bb79ea38e96bc84988aed726f017d1a1a1dd5352b3
                                    • Instruction ID: b55c2c1d0789c54b915d78e89c33e79a61f5ac3aa309572949986eb1be0b1d88
                                    • Opcode Fuzzy Hash: c63a8705ae77710e22cb38bb79ea38e96bc84988aed726f017d1a1a1dd5352b3
                                    • Instruction Fuzzy Hash: CA418D32A0CB4282E620DF16A94017A7BA5FB85B90F344175EA8DC7BE4EF7DE456C740
                                    Function 00007FF60F1855E0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00007FF60F186DC0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?), ref: 00007FF60F186DFA
                                    • ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF60F185931,?,?,00000000,?,?,00007FF60F1858AD), ref: 00007FF60F18563F
                                    Strings
                                    • LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF60F185616
                                    • LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF60F185653
                                    • LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF60F18569A
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: ByteCharEnvironmentExpandMultiStringsWide
                                    • String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
                                    • API String ID: 2001182103-3498232454
                                    • Opcode ID: 685ac72506e3a068510bc5613cf0a33b36cee39f446b40950092050ae43c98ea
                                    • Instruction ID: ae98019972eabad49f558761b38b4b43f909f81e9b79b01545ffb93563a73b91
                                    • Opcode Fuzzy Hash: 685ac72506e3a068510bc5613cf0a33b36cee39f446b40950092050ae43c98ea
                                    • Instruction Fuzzy Hash: 68319671B1C78391FA24D721E6552FA6391EF987D0FB84472DA4EC27D6EF6CE10A8600
                                    Function 00007FF60F18C258 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • LoadLibraryExW.KERNEL32(?,?,?,00007FF60F18C50A,?,?,?,00007FF60F18C1FC,?,?,00000001,00007FF60F18BE19), ref: 00007FF60F18C2DD
                                    • GetLastError.KERNEL32(?,?,?,00007FF60F18C50A,?,?,?,00007FF60F18C1FC,?,?,00000001,00007FF60F18BE19), ref: 00007FF60F18C2EB
                                    • LoadLibraryExW.KERNEL32(?,?,?,00007FF60F18C50A,?,?,?,00007FF60F18C1FC,?,?,00000001,00007FF60F18BE19), ref: 00007FF60F18C315
                                    • FreeLibrary.KERNEL32(?,?,?,00007FF60F18C50A,?,?,?,00007FF60F18C1FC,?,?,00000001,00007FF60F18BE19), ref: 00007FF60F18C35B
                                    • GetProcAddress.KERNEL32(?,?,?,00007FF60F18C50A,?,?,?,00007FF60F18C1FC,?,?,00000001,00007FF60F18BE19), ref: 00007FF60F18C367
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: Library$Load$AddressErrorFreeLastProc
                                    • String ID: api-ms-
                                    • API String ID: 2559590344-2084034818
                                    • Opcode ID: 9fa3fe7d6df773d1c5bf24e67e430f6ff715784c160aee4fa5e303400e9c878a
                                    • Instruction ID: 1dab59cd3850761fabaf282e6818e0353c02412d5ab5b3c84a0f5c9e6cc29461
                                    • Opcode Fuzzy Hash: 9fa3fe7d6df773d1c5bf24e67e430f6ff715784c160aee4fa5e303400e9c878a
                                    • Instruction Fuzzy Hash: 1F31A031A1EA4292EE529B16AA0097933D4FF48BA0F790575DD1DCA390EF7CE44A8760
                                    Function 00007FF60F186DC0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON
                                    Download Yara Rule
                                    APIs
                                    • MultiByteToWideChar.KERNEL32(?,?,?,?,?,?), ref: 00007FF60F186DFA
                                      • Part of subcall function 00007FF60F181CB0: GetLastError.KERNEL32(?,?,00000000,00007FF60F186914,?,?,?,?,?,?,?,?,?,?,?,00007FF60F181023), ref: 00007FF60F181CD7
                                    • MultiByteToWideChar.KERNEL32(?,?,?,?,?,?), ref: 00007FF60F186E80
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: ByteCharMultiWide$ErrorLast
                                    • String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                    • API String ID: 1717984340-876015163
                                    • Opcode ID: 13a0b7f3fd21cee1c2cd62ee385234548c1439332c91f829e0dfe80559821203
                                    • Instruction ID: afb8313ac547d321dde3dad9cf0bb63d46e1a276f752fcae517dcc1194220c06
                                    • Opcode Fuzzy Hash: 13a0b7f3fd21cee1c2cd62ee385234548c1439332c91f829e0dfe80559821203
                                    • Instruction Fuzzy Hash: 59218032B0CA4281EB50CB29F94016AA7A1FF88BC4F684171DB5CD3BA9EF6DD5568700
                                    Function 00007FF60F19A790 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • GetLastError.KERNEL32(?,?,?,00007FF60F1A24C3,?,?,?,00007FF60F19CCFC,?,?,00000000,00007FF60F19387F,?,?,?,00007FF60F199483), ref: 00007FF60F19A79F
                                    • FlsGetValue.KERNEL32(?,?,?,00007FF60F1A24C3,?,?,?,00007FF60F19CCFC,?,?,00000000,00007FF60F19387F,?,?,?,00007FF60F199483), ref: 00007FF60F19A7B4
                                    • FlsSetValue.KERNEL32(?,?,?,00007FF60F1A24C3,?,?,?,00007FF60F19CCFC,?,?,00000000,00007FF60F19387F,?,?,?,00007FF60F199483), ref: 00007FF60F19A7D5
                                    • FlsSetValue.KERNEL32(?,?,?,00007FF60F1A24C3,?,?,?,00007FF60F19CCFC,?,?,00000000,00007FF60F19387F,?,?,?,00007FF60F199483), ref: 00007FF60F19A802
                                    • FlsSetValue.KERNEL32(?,?,?,00007FF60F1A24C3,?,?,?,00007FF60F19CCFC,?,?,00000000,00007FF60F19387F,?,?,?,00007FF60F199483), ref: 00007FF60F19A813
                                    • FlsSetValue.KERNEL32(?,?,?,00007FF60F1A24C3,?,?,?,00007FF60F19CCFC,?,?,00000000,00007FF60F19387F,?,?,?,00007FF60F199483), ref: 00007FF60F19A824
                                    • SetLastError.KERNEL32(?,?,?,00007FF60F1A24C3,?,?,?,00007FF60F19CCFC,?,?,00000000,00007FF60F19387F,?,?,?,00007FF60F199483), ref: 00007FF60F19A83F
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: Value$ErrorLast
                                    • String ID:
                                    • API String ID: 2506987500-0
                                    • Opcode ID: 2edf535838d47d07e159287e64e919bbb9833f77d9c5416c102145f594fa91aa
                                    • Instruction ID: a47da2e1d7a16cb90f0486ee15ad4254a3d90af82481120ea07558073646dd5d
                                    • Opcode Fuzzy Hash: 2edf535838d47d07e159287e64e919bbb9833f77d9c5416c102145f594fa91aa
                                    • Instruction Fuzzy Hash: 44214934E0C20381FA58A762A6421796752DF857B0F745AB8E83E87BD6DF2CB4468380
                                    Function 00007FF60F1A70FC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                    • String ID: CONOUT$
                                    • API String ID: 3230265001-3130406586
                                    • Opcode ID: 2b1705eb60c5a9ea67d3abf5815f39d96026ea1e9a70ddd12955119ba33cdf2b
                                    • Instruction ID: 70de6ad0b09347a84b926f752badb5f0623c1975da3e785d8671f8dd350fed92
                                    • Opcode Fuzzy Hash: 2b1705eb60c5a9ea67d3abf5815f39d96026ea1e9a70ddd12955119ba33cdf2b
                                    • Instruction Fuzzy Hash: 15114932A1CA42C6E7508B52B95432973E4FB88BE4F244274EA5EC7794DF7CD9188740
                                    Function 00007FF60F19A908 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • GetLastError.KERNEL32(?,?,?,00007FF60F1960A1,?,?,?,?,00007FF60F19DF2F,?,?,00000000,00007FF60F19AA26,?,?,?), ref: 00007FF60F19A917
                                    • FlsSetValue.KERNEL32(?,?,?,00007FF60F1960A1,?,?,?,?,00007FF60F19DF2F,?,?,00000000,00007FF60F19AA26,?,?,?), ref: 00007FF60F19A94D
                                    • FlsSetValue.KERNEL32(?,?,?,00007FF60F1960A1,?,?,?,?,00007FF60F19DF2F,?,?,00000000,00007FF60F19AA26,?,?,?), ref: 00007FF60F19A97A
                                    • FlsSetValue.KERNEL32(?,?,?,00007FF60F1960A1,?,?,?,?,00007FF60F19DF2F,?,?,00000000,00007FF60F19AA26,?,?,?), ref: 00007FF60F19A98B
                                    • FlsSetValue.KERNEL32(?,?,?,00007FF60F1960A1,?,?,?,?,00007FF60F19DF2F,?,?,00000000,00007FF60F19AA26,?,?,?), ref: 00007FF60F19A99C
                                    • SetLastError.KERNEL32(?,?,?,00007FF60F1960A1,?,?,?,?,00007FF60F19DF2F,?,?,00000000,00007FF60F19AA26,?,?,?), ref: 00007FF60F19A9B7
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: Value$ErrorLast
                                    • String ID:
                                    • API String ID: 2506987500-0
                                    • Opcode ID: 0908324b7ac9a3d747a6848fb68d48d79e4d89c371889db26e425d0a64325479
                                    • Instruction ID: a1df3e2b513a57359b5bdc778247ce4d0eba152f72dcfa7a1d1e192ddbade898
                                    • Opcode Fuzzy Hash: 0908324b7ac9a3d747a6848fb68d48d79e4d89c371889db26e425d0a64325479
                                    • Instruction Fuzzy Hash: 0D114A30A0C24382FA58A722A6621796782EF857B0F7557B8E87EC77C6DF2CA4454781
                                    Function 00007FF60F18BC18 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                    • String ID: csm$f
                                    • API String ID: 2395640692-629598281
                                    • Opcode ID: c81fa8b68ebdc3525af754f24f91b9dd724933d7398a71cb8b59e34543720a2d
                                    • Instruction ID: 334580deebd4fea7727ecf8b2a3d7d8828804920f22e9c79b0b3db33bf93d97d
                                    • Opcode Fuzzy Hash: c81fa8b68ebdc3525af754f24f91b9dd724933d7398a71cb8b59e34543720a2d
                                    • Instruction Fuzzy Hash: 0351A132A1D60296EB18CF15E544A6937A5FB84B8CF618670DE5F87748DFB9E842C700
                                    Function 00007FF60F198A50 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: AddressFreeHandleLibraryModuleProc
                                    • String ID: CorExitProcess$mscoree.dll
                                    • API String ID: 4061214504-1276376045
                                    • Opcode ID: 7b1d64ab01259317c918a4692f10d75b0eff9ac50a6035860a5edd4d678e03f2
                                    • Instruction ID: bb7357f9e92db7bce9ed1662652518c78692c6eec773665902a4bba6ea6b0d01
                                    • Opcode Fuzzy Hash: 7b1d64ab01259317c918a4692f10d75b0eff9ac50a6035860a5edd4d678e03f2
                                    • Instruction Fuzzy Hash: 06F06D31A1DB02C1EB108B25E85437A63A0FF8A7A1FA40679CA6E856E4DF2DD48DC340
                                    Function 00007FF60F1A8834 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: _set_statfp
                                    • String ID:
                                    • API String ID: 1156100317-0
                                    • Opcode ID: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
                                    • Instruction ID: 9eb9101c699e65de1ee379adb40c4086c2aa9c044128433da1ea37ee95c5da38
                                    • Opcode Fuzzy Hash: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
                                    • Instruction Fuzzy Hash: 5311A972E1CA1311F6581166E45537917C1EF95374F3806F4EA7ECA7DACF2CA94D4201
                                    Function 00007FF60F19A9D0 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • FlsGetValue.KERNEL32(?,?,?,00007FF60F199BE3,?,?,00000000,00007FF60F199E7E,?,?,?,?,?,00007FF60F191A50), ref: 00007FF60F19A9EF
                                    • FlsSetValue.KERNEL32(?,?,?,00007FF60F199BE3,?,?,00000000,00007FF60F199E7E,?,?,?,?,?,00007FF60F191A50), ref: 00007FF60F19AA0E
                                    • FlsSetValue.KERNEL32(?,?,?,00007FF60F199BE3,?,?,00000000,00007FF60F199E7E,?,?,?,?,?,00007FF60F191A50), ref: 00007FF60F19AA36
                                    • FlsSetValue.KERNEL32(?,?,?,00007FF60F199BE3,?,?,00000000,00007FF60F199E7E,?,?,?,?,?,00007FF60F191A50), ref: 00007FF60F19AA47
                                    • FlsSetValue.KERNEL32(?,?,?,00007FF60F199BE3,?,?,00000000,00007FF60F199E7E,?,?,?,?,?,00007FF60F191A50), ref: 00007FF60F19AA58
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: Value
                                    • String ID:
                                    • API String ID: 3702945584-0
                                    • Opcode ID: 09351de027a9279ca2a4c1b6434e165991dd483229a246c23f0232d6cbc44178
                                    • Instruction ID: 38270b1e304ab4b6927993794aa56ec2d81d1f2bba3b5807f7bc8ede010eae2d
                                    • Opcode Fuzzy Hash: 09351de027a9279ca2a4c1b6434e165991dd483229a246c23f0232d6cbc44178
                                    • Instruction Fuzzy Hash: 4A111C30F0C64242FA589325A65117A6742DF857F0F6497B8E83E867D6DF2CE8468780
                                    Function 00007FF60F19A864 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                    Download Yara Rule
                                    APIs
                                    • FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF60F1A24C3,?,?,?,00007FF60F19CCFC,?,?,00000000,00007FF60F19387F), ref: 00007FF60F19A875
                                    • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF60F1A24C3,?,?,?,00007FF60F19CCFC,?,?,00000000,00007FF60F19387F), ref: 00007FF60F19A894
                                    • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF60F1A24C3,?,?,?,00007FF60F19CCFC,?,?,00000000,00007FF60F19387F), ref: 00007FF60F19A8BC
                                    • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF60F1A24C3,?,?,?,00007FF60F19CCFC,?,?,00000000,00007FF60F19387F), ref: 00007FF60F19A8CD
                                    • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF60F1A24C3,?,?,?,00007FF60F19CCFC,?,?,00000000,00007FF60F19387F), ref: 00007FF60F19A8DE
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: Value
                                    • String ID:
                                    • API String ID: 3702945584-0
                                    • Opcode ID: 3503e44f68c09ab1fcc5f97d2f28d09950786fdc08e97e82da204339743e9a53
                                    • Instruction ID: 0549284f06115540e54ee3fd8268cdb9c02f8090884a346f19b327c080e87c8e
                                    • Opcode Fuzzy Hash: 3503e44f68c09ab1fcc5f97d2f28d09950786fdc08e97e82da204339743e9a53
                                    • Instruction Fuzzy Hash: 11110C34E0D20741FA6CA37664521796742CF863B0F785BB8E93ECA2C2DF2CB4464791
                                    Function 00007FF60F19F228 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: _invalid_parameter_noinfo
                                    • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                    • API String ID: 3215553584-1196891531
                                    • Opcode ID: c382c1c977a669aecc7822defb6d065999e88b5839408fc9f42df24ac2fd9b51
                                    • Instruction ID: 997da1e16eab6fe4920688f1267f6f206366283185fbfb4cc0f505aeb61f64ba
                                    • Opcode Fuzzy Hash: c382c1c977a669aecc7822defb6d065999e88b5839408fc9f42df24ac2fd9b51
                                    • Instruction Fuzzy Hash: 42818C36E0C242A5F7644E29815027C27A0EF21B88F7580B9DA4EDB695CF2DFA03D781
                                    Function 00007FF60F18D478 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: CallEncodePointerTranslator
                                    • String ID: MOC$RCC
                                    • API String ID: 3544855599-2084237596
                                    • Opcode ID: 9b170d5fd3c93297408b7667d730af6b03d447aa0970c9ad65c03f5590751db3
                                    • Instruction ID: 049dca43285347fd4b928fbdab967ff13f088476065c4bf36ed58a238b5d9042
                                    • Opcode Fuzzy Hash: 9b170d5fd3c93297408b7667d730af6b03d447aa0970c9ad65c03f5590751db3
                                    • Instruction Fuzzy Hash: B3616C77A08B458AEB10CF65E1803AD77A0FB45B8CF244266EE4D57B94DF78E056C700
                                    Function 00007FF60F18D7D4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                    • String ID: csm$csm
                                    • API String ID: 3896166516-3733052814
                                    • Opcode ID: 637ab8e9c70e0df228760242cb149b7cb456e558a6c876299bf740c7ea814677
                                    • Instruction ID: dcf1f883e1331dcb8f3e82494031e393d32bdbc8e23b4473efeb7a3186c62d71
                                    • Opcode Fuzzy Hash: 637ab8e9c70e0df228760242cb149b7cb456e558a6c876299bf740c7ea814677
                                    • Instruction Fuzzy Hash: FA51AF3290C3828AEB648F26A65437877A0FB45B88F244176DA9DC7BD5CFBCE452C701
                                    Function 00007FF60F182CD0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON
                                    Download Yara Rule
                                    APIs
                                    • GetModuleFileNameW.KERNEL32(?,00007FF60F1827C9,?,?,?,?,?,?), ref: 00007FF60F182D01
                                      • Part of subcall function 00007FF60F181CB0: GetLastError.KERNEL32(?,?,00000000,00007FF60F186914,?,?,?,?,?,?,?,?,?,?,?,00007FF60F181023), ref: 00007FF60F181CD7
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: ErrorFileLastModuleName
                                    • String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
                                    • API String ID: 2776309574-1977442011
                                    • Opcode ID: f4519b566fb866c0e24e0c0f6095b74e6cdfdbd0a944601a087909324ed073f8
                                    • Instruction ID: c6d4846d4f3738b5477f3cecc1d79a646c239fe24f0e496410d525d0f5a8a9d9
                                    • Opcode Fuzzy Hash: f4519b566fb866c0e24e0c0f6095b74e6cdfdbd0a944601a087909324ed073f8
                                    • Instruction Fuzzy Hash: 8601A731B1C642D1FA619724E9453F51391FF587C0F600072E94EC6296EF6CF206C710
                                    Function 00007FF60F19BBE0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: FileWrite$ConsoleErrorLastOutput
                                    • String ID:
                                    • API String ID: 2718003287-0
                                    • Opcode ID: 89395c3cea06f18251b83f2629999b57cc62c4450565b522e677bf7b2279916c
                                    • Instruction ID: 1731750f2af3ad2a765cf30141bcdecd8f80929f7202fd582fd3dc3537fc5cb4
                                    • Opcode Fuzzy Hash: 89395c3cea06f18251b83f2629999b57cc62c4450565b522e677bf7b2279916c
                                    • Instruction Fuzzy Hash: 06D11172B1CA8589E710CF75D4402AC37B5FB84B98B244276CE5E97B99DF38D116C780
                                    Function 00007FF60F19484C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                    • String ID:
                                    • API String ID: 2780335769-0
                                    • Opcode ID: 1de9790e05870a994c8cd512dc0bf73c5d0095e8d25e0a1662523fa2deb398d1
                                    • Instruction ID: 444c1294c5f1160b661bcbbe8b482cbe7e64b0952d9f5b360a28ba2d96b9fca3
                                    • Opcode Fuzzy Hash: 1de9790e05870a994c8cd512dc0bf73c5d0095e8d25e0a1662523fa2deb398d1
                                    • Instruction Fuzzy Hash: AD515932E0C6428AFB10DFB1D4613BD23A1EB48B98F248575DE4D97689DF38E486C790
                                    Function 00007FF60F1A4DCC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: _get_daylight$_invalid_parameter_noinfo
                                    • String ID: ?
                                    • API String ID: 1286766494-1684325040
                                    • Opcode ID: ea61919ac6f8524f279918af95d4a367ebe415bf813acb2bc51f70dff045491e
                                    • Instruction ID: 978ae74ebf90e094937b8bb1f20ce6b37c38800375173d8d08a2132d0207508e
                                    • Opcode Fuzzy Hash: ea61919ac6f8524f279918af95d4a367ebe415bf813acb2bc51f70dff045491e
                                    • Instruction Fuzzy Hash: 1A41E432A1C38246FB64DB26E40137AA790EB80BA4F344279EE5C87AE9DF7CD445C700
                                    Function 00007FF60F197FE0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                    Download Yara Rule
                                    APIs
                                    • _invalid_parameter_noinfo.LIBCMT ref: 00007FF60F198012
                                      • Part of subcall function 00007FF60F199F88: RtlFreeHeap.NTDLL(?,?,?,00007FF60F1A1ED2,?,?,?,00007FF60F1A1F0F,?,?,00000000,00007FF60F1A23D5,?,?,00000000,00007FF60F1A2307), ref: 00007FF60F199F9E
                                      • Part of subcall function 00007FF60F199F88: GetLastError.KERNEL32(?,?,?,00007FF60F1A1ED2,?,?,?,00007FF60F1A1F0F,?,?,00000000,00007FF60F1A23D5,?,?,00000000,00007FF60F1A2307), ref: 00007FF60F199FA8
                                    • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF60F18A495), ref: 00007FF60F198030
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
                                    • String ID: C:\Users\user\Desktop\run0796.exe
                                    • API String ID: 3580290477-3544362879
                                    • Opcode ID: 8d8b2631746941ed8e9d93c586c1e08c09f8ebf82f2c91caf3ed4a0a8a2970d8
                                    • Instruction ID: cbafe1c4a113985bc4ba705ccff5ed6d0fef9eba0b7b6cb292734d9eb082303f
                                    • Opcode Fuzzy Hash: 8d8b2631746941ed8e9d93c586c1e08c09f8ebf82f2c91caf3ed4a0a8a2970d8
                                    • Instruction Fuzzy Hash: 25417132A0CB528AE754DF26D8410BD77A4FF45B94BA44475E90E87B85DF3DE881C380
                                    Function 00007FF60F19C278 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: ErrorFileLastWrite
                                    • String ID: U
                                    • API String ID: 442123175-4171548499
                                    • Opcode ID: 4ebfda0eb3dddeb426bdf92ebf3ecfca638941ee1d5aabdffb869394d8dbdab1
                                    • Instruction ID: a2a0c6ab8c2acca39ed5a853e6f4e0cbfe2ca8db1914ced32b3cd5f134f35aa7
                                    • Opcode Fuzzy Hash: 4ebfda0eb3dddeb426bdf92ebf3ecfca638941ee1d5aabdffb869394d8dbdab1
                                    • Instruction Fuzzy Hash: 5D418032A1CA4296DB208F25E8447AA77A1FB88B94F904036EA8DC7798DF7CD545C780
                                    Function 00007FF60F19E598 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: CurrentDirectory
                                    • String ID: :
                                    • API String ID: 1611563598-336475711
                                    • Opcode ID: 6ea6d4d4bc35d25bba8af1de083b0a6473d04d25c8de49d1e69948f0a07f610c
                                    • Instruction ID: 0e27e7a44d936993938e5461c83913d7a8e5415e7c8f44ee9390162cfdabf6ac
                                    • Opcode Fuzzy Hash: 6ea6d4d4bc35d25bba8af1de083b0a6473d04d25c8de49d1e69948f0a07f610c
                                    • Instruction Fuzzy Hash: 8B21F172B0C68182FB24CB25D04426D73B2FB84B44FA58079DA9D83285CFBDE949CB91
                                    Function 00007FF60F18E320 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: ExceptionFileHeaderRaise
                                    • String ID: csm
                                    • API String ID: 2573137834-1018135373
                                    • Opcode ID: ca300da370bc200b47a9e29752d724a25d804681f54f6f31a4c62ce82835f912
                                    • Instruction ID: eee3c0535b133b55f052cf96bdf8a2a608836e5a3b83e95c76df4618a17f41bc
                                    • Opcode Fuzzy Hash: ca300da370bc200b47a9e29752d724a25d804681f54f6f31a4c62ce82835f912
                                    • Instruction Fuzzy Hash: EB114C3260CB4182EB618F15F54026977E1FB88B84F284270EE8D47758DF7CD956CB40
                                    Function 00007FF60F19F09C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.1695360038.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000000.00000002.1695334812.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695389254.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1695915868.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000000.00000002.1696384772.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: DriveType_invalid_parameter_noinfo
                                    • String ID: :
                                    • API String ID: 2595371189-336475711
                                    • Opcode ID: 5bb9208f1dd75f8da1bf4b84d43d2649c4580fde4fdc4700cc46879c1844a841
                                    • Instruction ID: 97a8c2114975a70ad4bed66a35c0286bc09d0236b21a536dcbfbd50ef7ff54a8
                                    • Opcode Fuzzy Hash: 5bb9208f1dd75f8da1bf4b84d43d2649c4580fde4fdc4700cc46879c1844a841
                                    • Instruction Fuzzy Hash: 0701D67291C20396F770AF60A46227E73A0EF44708FA8147AD54DC2695DF3DE546CB54

                                    Execution Graph

                                    Execution Coverage:2.6%
                                    Dynamic/Decrypted Code Coverage:0%
                                    Signature Coverage:0.9%
                                    Total number of Nodes:907
                                    Total number of Limit Nodes:29
                                    execution_graph 54673 7ffe13271000 WSAStartup 54674 7ffe1327104a 00007FFDFB5BC3F0 54673->54674 54677 7ffe13274144 54673->54677 54675 7ffe1327106a 54674->54675 54680 7ffe132710f7 54674->54680 54676 7ffe1327108e VerSetConditionMask VerSetConditionMask VerSetConditionMask VerifyVersionInfoW 54675->54676 54676->54680 54679 7ffe132720c2 54681 7ffe132720a8 54680->54681 54682 7ffe13271ffa VerSetConditionMask VerSetConditionMask VerSetConditionMask 54680->54682 54685 7ffe13272af0 RtlCaptureContext RtlLookupFunctionEntry capture_previous_context 54681->54685 54683 7ffe13272048 VerifyVersionInfoA 54682->54683 54683->54681 54684 7ffe13272065 54683->54684 54684->54681 54684->54683 54685->54679 54686 7ffe13287170 54687 7ffe13287188 54686->54687 54692 7ffe13287d5c 54686->54692 54688 7ffe13287c73 LoadLibraryA 54687->54688 54691 7ffe13287cce VirtualProtect VirtualProtect 54687->54691 54689 7ffe13287c8d 54688->54689 54689->54687 54693 7ffe13287cac GetProcAddress 54689->54693 54691->54692 54692->54692 54693->54689 54694 7ffe13287cc3 54693->54694 54695 7ffe01388980 54696 7ffe013889a8 54695->54696 54697 7ffe01388994 54695->54697 54758 7ffe013c25e4 GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter 54696->54758 54699 7ffe013889ce 54697->54699 54700 7ffe01388af1 54697->54700 54702 7ffe01388ac7 54699->54702 54703 7ffe013889d7 54699->54703 54701 7ffe01388a8d 54700->54701 54767 7ffe013859bc 197 API calls 54700->54767 54743 7ffe013c1a18 54702->54743 54705 7ffe01388a9f 54703->54705 54706 7ffe013889e0 GetLastError 54703->54706 54705->54701 54711 7ffe01388aaf 54705->54711 54707 7ffe013889f8 54706->54707 54708 7ffe013889f3 54706->54708 54716 7ffe013c8577 54707->54716 54760 7ffe01388b20 6 API calls wmemcpy_s 54707->54760 54759 7ffe0138d4d0 6 API calls wmemcpy_s 54708->54759 54766 7ffe0138d4d0 6 API calls wmemcpy_s 54711->54766 54713 7ffe01388a13 54717 7ffe013c8599 SetLastError 54713->54717 54761 7ffe0138e040 25 API calls 3 library calls 54713->54761 54714 7ffe01388b1c 54714->54701 54718 7ffe01388ab4 54714->54718 54716->54717 54725 7ffe01388a60 54716->54725 54723 7ffe01388ae1 54717->54723 54718->54701 54768 7ffe01388b20 6 API calls wmemcpy_s 54718->54768 54719 7ffe01388acc 54719->54701 54751 7ffe01387504 54719->54751 54723->54701 54772 7ffe013c1a50 8 API calls 3 library calls 54723->54772 54724 7ffe01388a2a 54729 7ffe013c8582 54724->54729 54762 7ffe01388b20 6 API calls wmemcpy_s 54724->54762 54725->54717 54727 7ffe01388a69 54725->54727 54726 7ffe013c8569 54769 7ffe0139a280 29 API calls __std_type_info_name 54726->54769 54765 7ffe0138d4d0 6 API calls wmemcpy_s 54727->54765 54770 7ffe01388b20 6 API calls wmemcpy_s 54729->54770 54731 7ffe013c8571 54731->54701 54735 7ffe01388a74 SetLastError 54735->54701 54736 7ffe01388a49 54736->54729 54738 7ffe01388a51 54736->54738 54737 7ffe013c858f 54771 7ffe013980a4 25 API calls __std_type_info_name 54737->54771 54763 7ffe01389b80 25 API calls wmemcpy_s 54738->54763 54741 7ffe01388a59 54764 7ffe0138e510 25 API calls 2 library calls 54741->54764 54744 7ffe013c1a21 54743->54744 54773 7ffe013c1e08 54744->54773 54747 7ffe013c1a34 54747->54719 54749 7ffe013c1a3d 54749->54747 54780 7ffe013c1e6c DeleteCriticalSection 54749->54780 54754 7ffe01387522 54751->54754 54756 7ffe0138757c 54751->54756 54752 7ffe0138759e 54752->54754 54805 7ffe01387390 7 API calls 2 library calls 54752->54805 54754->54752 54754->54756 54797 7ffe013874c0 EnterCriticalSection 54754->54797 54806 7ffe013874a0 6 API calls 54754->54806 54756->54723 54758->54697 54759->54707 54760->54713 54761->54724 54762->54736 54763->54741 54764->54725 54765->54735 54766->54718 54767->54714 54768->54726 54769->54731 54770->54737 54771->54717 54772->54701 54774 7ffe013c1e10 54773->54774 54776 7ffe013c1e41 54774->54776 54777 7ffe013c1a30 54774->54777 54781 7ffe013c21f4 54774->54781 54786 7ffe013c1e6c DeleteCriticalSection 54776->54786 54777->54747 54779 7ffe013c1bb4 8 API calls 3 library calls 54777->54779 54779->54749 54780->54747 54787 7ffe013c1ef0 54781->54787 54784 7ffe013c223f InitializeCriticalSectionAndSpinCount 54785 7ffe013c2234 54784->54785 54785->54774 54786->54777 54788 7ffe013c1f51 54787->54788 54795 7ffe013c1f4c try_get_function 54787->54795 54788->54784 54788->54785 54789 7ffe013c2034 54789->54788 54791 7ffe013c2042 GetProcAddress 54789->54791 54790 7ffe013c1f80 LoadLibraryExW 54792 7ffe013c1fa1 GetLastError 54790->54792 54790->54795 54793 7ffe013c2053 54791->54793 54792->54795 54793->54788 54794 7ffe013c2019 FreeLibrary 54794->54795 54795->54788 54795->54789 54795->54790 54795->54794 54796 7ffe013c1fdb LoadLibraryExW 54795->54796 54796->54795 54807 7ffe013861ac 54797->54807 54799 7ffe013874dc 54800 7ffe013874ec LeaveCriticalSection 54799->54800 54819 7ffe0138624c GetStartupInfoW 54799->54819 54800->54754 54805->54752 54806->54754 54808 7ffe013861cf EnterCriticalSection 54807->54808 54809 7ffe013c7e82 54807->54809 54811 7ffe013861e7 54808->54811 54831 7ffe013938f0 25 API calls 3 library calls 54809->54831 54813 7ffe01386226 LeaveCriticalSection 54811->54813 54815 7ffe013861fd 54811->54815 54812 7ffe013c7e87 54832 7ffe013ed020 37 API calls wmemcpy_s 54812->54832 54813->54799 54815->54811 54818 7ffe01386221 54815->54818 54830 7ffe01385ff0 27 API calls 2 library calls 54815->54830 54816 7ffe013c7e93 54818->54813 54820 7ffe01386281 54819->54820 54821 7ffe013c7e9a 54819->54821 54825 7ffe013862a0 54820->54825 54821->54820 54822 7ffe013861ac 41 API calls 54821->54822 54823 7ffe013c7ec3 54822->54823 54823->54820 54824 7ffe013c7ef1 GetFileType 54823->54824 54824->54823 54826 7ffe013862ba 54825->54826 54827 7ffe013862fc GetStdHandle 54826->54827 54829 7ffe01386337 54826->54829 54827->54826 54828 7ffe0138630f GetFileType 54827->54828 54828->54826 54829->54800 54830->54815 54831->54812 54832->54816 54833 7ff60f19c8a8 54844 7ff60f1992f4 54833->54844 54836 7ff60f19c96e 54855 7ff60f19c480 69 API calls 2 library calls 54836->54855 54837 7ff60f19c8dd 54839 7ff60f19c8fb 54837->54839 54842 7ff60f19c919 54837->54842 54854 7ff60f19c480 69 API calls 2 library calls 54839->54854 54841 7ff60f19c909 54842->54841 54850 7ff60f19b820 54842->54850 54845 7ff60f19930d 54844->54845 54846 7ff60f1992fd 54844->54846 54845->54836 54845->54837 54856 7ff60f196098 11 API calls _wfindfirst32i64 54846->54856 54848 7ff60f199302 54857 7ff60f199f20 37 API calls _invalid_parameter_noinfo 54848->54857 54851 7ff60f19b850 54850->54851 54858 7ff60f19b654 54851->54858 54853 7ff60f19b869 54853->54841 54854->54841 54855->54841 54856->54848 54860 7ff60f19b6ab 54858->54860 54868 7ff60f19b67d 54858->54868 54859 7ff60f19b6c4 54870 7ff60f199e54 37 API calls 2 library calls 54859->54870 54860->54859 54862 7ff60f19b71b 54860->54862 54869 7ff60f196d60 EnterCriticalSection 54862->54869 54864 7ff60f19b722 54865 7ff60f19b739 54864->54865 54866 7ff60f19b774 _fread_nolock 39 API calls 54864->54866 54867 7ff60f196e48 _fread_nolock LeaveCriticalSection 54865->54867 54866->54865 54867->54868 54868->54853 54870->54868 54871 7ffe148eab70 54872 7ffe148eab88 54871->54872 54876 7ffe148eb75c 54871->54876 54873 7ffe148eb673 LoadLibraryA 54872->54873 54875 7ffe148eb6ce VirtualProtect VirtualProtect 54872->54875 54878 7ffe148eb68d 54873->54878 54875->54876 54877 7ffe148eb6ac GetProcAddress 54877->54878 54879 7ffe148eb6c3 54877->54879 54878->54872 54878->54877 54880 7ff60f18a52c 54901 7ff60f18a70c 54880->54901 54883 7ff60f18a683 55000 7ff60f18aa3c 7 API calls 2 library calls 54883->55000 54884 7ff60f18a54d __scrt_acquire_startup_lock 54886 7ff60f18a68d 54884->54886 54892 7ff60f18a56b __scrt_release_startup_lock 54884->54892 55001 7ff60f18aa3c 7 API calls 2 library calls 54886->55001 54888 7ff60f18a590 54889 7ff60f18a698 __CxxCallCatchBlock 54890 7ff60f18a616 54909 7ff60f198748 54890->54909 54892->54888 54892->54890 54997 7ff60f198af4 45 API calls 54892->54997 54894 7ff60f18a61b 54915 7ff60f181000 54894->54915 54898 7ff60f18a63f 54898->54889 54999 7ff60f18a8a0 7 API calls __scrt_initialize_crt 54898->54999 54900 7ff60f18a656 54900->54888 55002 7ff60f18acdc 54901->55002 54904 7ff60f18a545 54904->54883 54904->54884 54905 7ff60f18a73b 55004 7ff60f1991fc 54905->55004 54910 7ff60f19876d 54909->54910 54911 7ff60f198758 54909->54911 54910->54894 54911->54910 55021 7ff60f1981d8 40 API calls __free_lconv_mon 54911->55021 54913 7ff60f198776 54913->54910 55022 7ff60f198598 12 API calls 3 library calls 54913->55022 54916 7ff60f181011 54915->54916 55023 7ff60f1867d0 54916->55023 54918 7ff60f181023 55030 7ff60f194f8c 54918->55030 54920 7ff60f1827ab 55037 7ff60f181af0 54920->55037 54923 7ff60f1828ca 55143 7ff60f18a110 54923->55143 54927 7ff60f1827c9 54927->54923 55053 7ff60f182c50 54927->55053 54929 7ff60f1827fb 54929->54923 55056 7ff60f185af0 54929->55056 54931 7ff60f182817 54932 7ff60f182863 54931->54932 54934 7ff60f185af0 92 API calls 54931->54934 55071 7ff60f186100 54932->55071 54939 7ff60f182838 __std_exception_copy 54934->54939 54935 7ff60f182878 55075 7ff60f1819d0 54935->55075 54938 7ff60f18296d 54941 7ff60f182998 54938->54941 55176 7ff60f1824a0 86 API calls 54938->55176 54939->54932 54944 7ff60f186100 89 API calls 54939->54944 54940 7ff60f1819d0 121 API calls 54943 7ff60f1828ae 54940->54943 54949 7ff60f1829db 54941->54949 55086 7ff60f186dc0 54941->55086 54947 7ff60f1828b2 54943->54947 54948 7ff60f1828f0 54943->54948 54944->54932 54946 7ff60f1829b8 54950 7ff60f1829bd 54946->54950 54951 7ff60f1829ce SetDllDirectoryW 54946->54951 55142 7ff60f181c50 86 API calls 54947->55142 54948->54938 55152 7ff60f182de0 54948->55152 55100 7ff60f184fa0 54949->55100 55177 7ff60f181c50 86 API calls 54950->55177 54951->54949 54958 7ff60f182912 55175 7ff60f181c50 86 API calls 54958->55175 54961 7ff60f182940 54961->54938 54964 7ff60f182945 54961->54964 54963 7ff60f1829f8 54985 7ff60f182a2a 54963->54985 55179 7ff60f1847a0 158 API calls 3 library calls 54963->55179 55171 7ff60f18e61c 54964->55171 54965 7ff60f182af6 55132 7ff60f182330 54965->55132 54969 7ff60f182a09 54972 7ff60f182a2c 54969->54972 55180 7ff60f184720 120 API calls 54969->55180 54971 7ff60f182a49 54977 7ff60f182a95 54971->54977 55183 7ff60f181b30 54971->55183 55182 7ff60f1849f0 FreeLibrary 54972->55182 54977->54923 55104 7ff60f1822d0 54977->55104 54978 7ff60f182a17 54978->54972 54980 7ff60f182a1b 54978->54980 54979 7ff60f182b2b 54981 7ff60f185af0 92 API calls 54979->54981 55181 7ff60f184df0 87 API calls 54980->55181 54984 7ff60f182b37 54981->54984 54984->54923 54987 7ff60f182b48 54984->54987 54985->54965 54985->54971 54986 7ff60f182ad1 55187 7ff60f1849f0 FreeLibrary 54986->55187 55189 7ff60f186140 94 API calls 2 library calls 54987->55189 54990 7ff60f182b60 55190 7ff60f1849f0 FreeLibrary 54990->55190 54992 7ff60f182b87 55192 7ff60f181ab0 74 API calls __std_exception_copy 54992->55192 54993 7ff60f182b6c 54993->54992 55191 7ff60f185e00 98 API calls 2 library calls 54993->55191 54996 7ff60f182b8f 54996->54923 54997->54890 54998 7ff60f18ab90 GetModuleHandleW 54998->54898 54999->54900 55000->54886 55001->54889 55003 7ff60f18a72e __scrt_dllmain_crt_thread_attach 55002->55003 55003->54904 55003->54905 55005 7ff60f1a265c 55004->55005 55006 7ff60f18a740 55005->55006 55009 7ff60f19bb60 55005->55009 55006->54904 55008 7ff60f18be38 7 API calls 2 library calls 55006->55008 55008->54904 55020 7ff60f19f818 EnterCriticalSection 55009->55020 55011 7ff60f19bb70 55012 7ff60f196cb8 43 API calls 55011->55012 55013 7ff60f19bb79 55012->55013 55014 7ff60f19b968 45 API calls 55013->55014 55019 7ff60f19bb87 55013->55019 55016 7ff60f19bb82 55014->55016 55015 7ff60f19f878 _isindst LeaveCriticalSection 55017 7ff60f19bb93 55015->55017 55018 7ff60f19ba58 GetStdHandle GetFileType 55016->55018 55017->55005 55018->55019 55019->55015 55021->54913 55022->54910 55026 7ff60f1867ef 55023->55026 55024 7ff60f186840 WideCharToMultiByte 55024->55026 55029 7ff60f1868e8 55024->55029 55025 7ff60f1867f7 __std_exception_copy 55025->54918 55026->55024 55026->55025 55028 7ff60f186896 WideCharToMultiByte 55026->55028 55026->55029 55028->55026 55028->55029 55193 7ff60f181cb0 86 API calls 55029->55193 55033 7ff60f19ecd0 55030->55033 55031 7ff60f19ed23 55194 7ff60f199e54 37 API calls 2 library calls 55031->55194 55033->55031 55034 7ff60f19ed76 55033->55034 55195 7ff60f19eba8 71 API calls _fread_nolock 55034->55195 55036 7ff60f19ed4c 55036->54920 55038 7ff60f181b05 55037->55038 55039 7ff60f181b20 55038->55039 55196 7ff60f181c10 86 API calls 55038->55196 55039->54923 55041 7ff60f182cd0 55039->55041 55197 7ff60f18a140 55041->55197 55044 7ff60f182d0b 55199 7ff60f181cb0 86 API calls 55044->55199 55045 7ff60f182d22 55200 7ff60f186ed0 88 API calls 55045->55200 55048 7ff60f182d35 55049 7ff60f182d1e 55048->55049 55201 7ff60f181c50 86 API calls 55048->55201 55051 7ff60f18a110 _wfindfirst32i64 8 API calls 55049->55051 55052 7ff60f182d5f 55051->55052 55052->54927 55054 7ff60f181b30 49 API calls 55053->55054 55055 7ff60f182c6d 55054->55055 55055->54929 55057 7ff60f185afa 55056->55057 55058 7ff60f186dc0 88 API calls 55057->55058 55059 7ff60f185b1c GetEnvironmentVariableW 55058->55059 55060 7ff60f185b86 55059->55060 55061 7ff60f185b34 ExpandEnvironmentStringsW 55059->55061 55063 7ff60f18a110 _wfindfirst32i64 8 API calls 55060->55063 55202 7ff60f186ed0 88 API calls 55061->55202 55065 7ff60f185b98 55063->55065 55064 7ff60f185b5c 55064->55060 55066 7ff60f185b66 55064->55066 55065->54931 55203 7ff60f19927c 37 API calls 2 library calls 55066->55203 55068 7ff60f185b6e 55069 7ff60f18a110 _wfindfirst32i64 8 API calls 55068->55069 55070 7ff60f185b7e 55069->55070 55070->54931 55072 7ff60f186dc0 88 API calls 55071->55072 55073 7ff60f186117 SetEnvironmentVariableW 55072->55073 55074 7ff60f18612f __std_exception_copy 55073->55074 55074->54935 55076 7ff60f181b30 49 API calls 55075->55076 55077 7ff60f181a00 55076->55077 55078 7ff60f181b30 49 API calls 55077->55078 55084 7ff60f181a7a 55077->55084 55079 7ff60f181a22 55078->55079 55080 7ff60f182c50 49 API calls 55079->55080 55079->55084 55081 7ff60f181a3b 55080->55081 55204 7ff60f1817b0 55081->55204 55084->54938 55084->54940 55085 7ff60f18e61c 74 API calls 55085->55084 55087 7ff60f186e67 MultiByteToWideChar 55086->55087 55088 7ff60f186de1 MultiByteToWideChar 55086->55088 55091 7ff60f186e8a 55087->55091 55092 7ff60f186eaf 55087->55092 55089 7ff60f186e2c 55088->55089 55090 7ff60f186e07 55088->55090 55089->55087 55097 7ff60f186e42 55089->55097 55287 7ff60f181cb0 86 API calls 55090->55287 55289 7ff60f181cb0 86 API calls 55091->55289 55092->54946 55095 7ff60f186e1a 55095->54946 55096 7ff60f186e9d 55096->54946 55288 7ff60f181cb0 86 API calls 55097->55288 55099 7ff60f186e55 55099->54946 55101 7ff60f184fb5 55100->55101 55102 7ff60f1829e0 55101->55102 55290 7ff60f181c10 86 API calls 55101->55290 55102->54985 55178 7ff60f184c40 120 API calls 2 library calls 55102->55178 55291 7ff60f183ac0 55104->55291 55107 7ff60f18231d 55107->54986 55109 7ff60f1822f4 55109->55107 55347 7ff60f183840 55109->55347 55111 7ff60f182300 55111->55107 55357 7ff60f1839a0 55111->55357 55113 7ff60f18230c 55113->55107 55114 7ff60f18255c 55113->55114 55115 7ff60f182547 55113->55115 55117 7ff60f18257c 55114->55117 55129 7ff60f182592 __std_exception_copy 55114->55129 55388 7ff60f181c50 86 API calls 55115->55388 55389 7ff60f181c50 86 API calls 55117->55389 55118 7ff60f18a110 _wfindfirst32i64 8 API calls 55120 7ff60f1826ea 55118->55120 55120->54986 55121 7ff60f182553 55121->55118 55124 7ff60f181b30 49 API calls 55124->55129 55125 7ff60f18273f 55393 7ff60f181c50 86 API calls 55125->55393 55127 7ff60f182719 55392 7ff60f181c50 86 API calls 55127->55392 55129->55121 55129->55124 55129->55125 55129->55127 55130 7ff60f1826f6 55129->55130 55362 7ff60f1812b0 55129->55362 55390 7ff60f181780 86 API calls 55129->55390 55391 7ff60f181c50 86 API calls 55130->55391 55134 7ff60f1823e4 55132->55134 55138 7ff60f1823a3 55132->55138 55133 7ff60f182423 55136 7ff60f18a110 _wfindfirst32i64 8 API calls 55133->55136 55134->55133 55538 7ff60f181ab0 74 API calls __std_exception_copy 55134->55538 55137 7ff60f182435 55136->55137 55137->54923 55188 7ff60f186090 88 API calls __std_exception_copy 55137->55188 55138->55134 55482 7ff60f181dc0 55138->55482 55537 7ff60f181440 158 API calls 2 library calls 55138->55537 55539 7ff60f181780 86 API calls 55138->55539 55142->54923 55144 7ff60f18a119 55143->55144 55145 7ff60f1828de 55144->55145 55146 7ff60f18a1d0 IsProcessorFeaturePresent 55144->55146 55145->54998 55147 7ff60f18a1e8 55146->55147 55688 7ff60f18a3c4 RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 55147->55688 55149 7ff60f18a1fb 55689 7ff60f18a190 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 55149->55689 55153 7ff60f182dec 55152->55153 55154 7ff60f186dc0 88 API calls 55153->55154 55155 7ff60f182e17 55154->55155 55156 7ff60f186dc0 88 API calls 55155->55156 55157 7ff60f182e2a 55156->55157 55690 7ff60f195548 55157->55690 55160 7ff60f18a110 _wfindfirst32i64 8 API calls 55161 7ff60f18290a 55160->55161 55161->54958 55162 7ff60f186370 55161->55162 55163 7ff60f186394 55162->55163 55164 7ff60f18eca4 73 API calls 55163->55164 55169 7ff60f18646b __std_exception_copy 55163->55169 55165 7ff60f1863ae 55164->55165 55165->55169 55861 7ff60f197aac 55165->55861 55167 7ff60f18eca4 73 API calls 55170 7ff60f1863c3 55167->55170 55168 7ff60f18e96c _fread_nolock 53 API calls 55168->55170 55169->54961 55170->55167 55170->55168 55170->55169 55172 7ff60f18e64c 55171->55172 55877 7ff60f18e3f8 55172->55877 55174 7ff60f18e665 55174->54958 55175->54923 55176->54941 55177->54923 55178->54963 55179->54969 55180->54978 55181->54985 55182->54985 55184 7ff60f181b55 55183->55184 55185 7ff60f193c90 49 API calls 55184->55185 55186 7ff60f181b78 55185->55186 55186->54977 55187->54923 55188->54979 55189->54990 55190->54993 55191->54992 55192->54996 55193->55025 55194->55036 55195->55036 55196->55039 55198 7ff60f182cdc GetModuleFileNameW 55197->55198 55198->55044 55198->55045 55199->55049 55200->55048 55201->55049 55202->55064 55203->55068 55205 7ff60f1817d4 55204->55205 55206 7ff60f1817e4 55204->55206 55207 7ff60f182de0 120 API calls 55205->55207 55208 7ff60f186370 83 API calls 55206->55208 55211 7ff60f181842 55206->55211 55207->55206 55209 7ff60f181815 55208->55209 55209->55211 55238 7ff60f18eca4 55209->55238 55212 7ff60f18a110 _wfindfirst32i64 8 API calls 55211->55212 55214 7ff60f1819c0 55212->55214 55213 7ff60f18182b 55215 7ff60f18184c 55213->55215 55216 7ff60f18182f 55213->55216 55214->55084 55214->55085 55242 7ff60f18e96c 55215->55242 55251 7ff60f181c10 86 API calls 55216->55251 55220 7ff60f181867 55252 7ff60f181c10 86 API calls 55220->55252 55221 7ff60f18eca4 73 API calls 55223 7ff60f1818d1 55221->55223 55224 7ff60f1818e3 55223->55224 55225 7ff60f1818fe 55223->55225 55253 7ff60f181c10 86 API calls 55224->55253 55227 7ff60f18e96c _fread_nolock 53 API calls 55225->55227 55228 7ff60f181913 55227->55228 55228->55220 55229 7ff60f181925 55228->55229 55245 7ff60f18e6e0 55229->55245 55232 7ff60f18193d 55254 7ff60f181c50 86 API calls 55232->55254 55234 7ff60f181993 55234->55211 55235 7ff60f18e61c 74 API calls 55234->55235 55235->55211 55236 7ff60f181950 55236->55234 55255 7ff60f181c50 86 API calls 55236->55255 55239 7ff60f18ecd4 55238->55239 55256 7ff60f18ea34 55239->55256 55241 7ff60f18eced 55241->55213 55269 7ff60f18e98c 55242->55269 55246 7ff60f18e6e9 55245->55246 55247 7ff60f181939 55245->55247 55285 7ff60f196098 11 API calls _wfindfirst32i64 55246->55285 55247->55232 55247->55236 55249 7ff60f18e6ee 55286 7ff60f199f20 37 API calls _invalid_parameter_noinfo 55249->55286 55251->55211 55252->55211 55253->55211 55254->55211 55255->55234 55257 7ff60f18ea9e 55256->55257 55258 7ff60f18ea5e 55256->55258 55257->55258 55260 7ff60f18eaaa 55257->55260 55268 7ff60f199e54 37 API calls 2 library calls 55258->55268 55267 7ff60f19439c EnterCriticalSection 55260->55267 55262 7ff60f18eaaf 55263 7ff60f18ebb8 71 API calls 55262->55263 55264 7ff60f18eac1 55263->55264 55265 7ff60f1943a8 _fread_nolock LeaveCriticalSection 55264->55265 55266 7ff60f18ea85 55265->55266 55266->55241 55268->55266 55270 7ff60f18e9b6 55269->55270 55281 7ff60f181861 55269->55281 55271 7ff60f18ea02 55270->55271 55272 7ff60f18e9c5 memcpy_s 55270->55272 55270->55281 55282 7ff60f19439c EnterCriticalSection 55271->55282 55283 7ff60f196098 11 API calls _wfindfirst32i64 55272->55283 55275 7ff60f18ea0a 55277 7ff60f18e70c _fread_nolock 51 API calls 55275->55277 55276 7ff60f18e9da 55284 7ff60f199f20 37 API calls _invalid_parameter_noinfo 55276->55284 55279 7ff60f18ea21 55277->55279 55280 7ff60f1943a8 _fread_nolock LeaveCriticalSection 55279->55280 55280->55281 55281->55220 55281->55221 55283->55276 55285->55249 55287->55095 55288->55099 55289->55096 55290->55102 55292 7ff60f183ad0 55291->55292 55293 7ff60f181b30 49 API calls 55292->55293 55294 7ff60f183b02 55293->55294 55295 7ff60f183b2b 55294->55295 55296 7ff60f183b0b 55294->55296 55298 7ff60f183b82 55295->55298 55394 7ff60f182e60 55295->55394 55407 7ff60f181c50 86 API calls 55296->55407 55299 7ff60f182e60 49 API calls 55298->55299 55302 7ff60f183b9b 55299->55302 55300 7ff60f183b21 55305 7ff60f18a110 _wfindfirst32i64 8 API calls 55300->55305 55306 7ff60f183bb9 55302->55306 55409 7ff60f181c50 86 API calls 55302->55409 55303 7ff60f183b4c 55304 7ff60f183b6a 55303->55304 55408 7ff60f181c50 86 API calls 55303->55408 55397 7ff60f182d70 55304->55397 55309 7ff60f1822de 55305->55309 55311 7ff60f186320 89 API calls 55306->55311 55309->55107 55319 7ff60f183e40 55309->55319 55313 7ff60f183bc6 55311->55313 55314 7ff60f183bed 55313->55314 55315 7ff60f183bcb 55313->55315 55411 7ff60f182f20 141 API calls 55314->55411 55410 7ff60f181cb0 86 API calls 55315->55410 55320 7ff60f185af0 92 API calls 55319->55320 55322 7ff60f183e55 55320->55322 55321 7ff60f183e70 55323 7ff60f186dc0 88 API calls 55321->55323 55322->55321 55439 7ff60f181c50 86 API calls 55322->55439 55325 7ff60f183eb4 55323->55325 55326 7ff60f183eb9 55325->55326 55327 7ff60f183ed0 55325->55327 55440 7ff60f181c50 86 API calls 55326->55440 55330 7ff60f186dc0 88 API calls 55327->55330 55329 7ff60f183ec5 55329->55109 55331 7ff60f183f05 55330->55331 55334 7ff60f181b30 49 API calls 55331->55334 55345 7ff60f183f0a __std_exception_copy 55331->55345 55333 7ff60f1840b1 55333->55109 55335 7ff60f183f87 55334->55335 55336 7ff60f183fb3 55335->55336 55337 7ff60f183f8e 55335->55337 55338 7ff60f186dc0 88 API calls 55336->55338 55441 7ff60f181c50 86 API calls 55337->55441 55341 7ff60f183fcc 55338->55341 55340 7ff60f183fa3 55340->55109 55341->55345 55412 7ff60f183c20 55341->55412 55346 7ff60f18409a 55345->55346 55443 7ff60f181c50 86 API calls 55345->55443 55346->55109 55348 7ff60f183857 55347->55348 55348->55348 55349 7ff60f183880 55348->55349 55355 7ff60f183897 __std_exception_copy 55348->55355 55451 7ff60f181c50 86 API calls 55349->55451 55351 7ff60f18388c 55351->55111 55352 7ff60f18397b 55352->55111 55353 7ff60f1812b0 120 API calls 55353->55355 55355->55352 55355->55353 55452 7ff60f181c50 86 API calls 55355->55452 55453 7ff60f181780 86 API calls 55355->55453 55358 7ff60f183aa7 55357->55358 55360 7ff60f1839bb 55357->55360 55358->55113 55360->55358 55361 7ff60f181c50 86 API calls 55360->55361 55454 7ff60f181780 86 API calls 55360->55454 55361->55360 55363 7ff60f1812f8 55362->55363 55364 7ff60f1812c6 55362->55364 55366 7ff60f18eca4 73 API calls 55363->55366 55365 7ff60f182de0 120 API calls 55364->55365 55367 7ff60f1812d6 55365->55367 55368 7ff60f18130a 55366->55368 55367->55363 55369 7ff60f1812de 55367->55369 55370 7ff60f18132f 55368->55370 55371 7ff60f18130e 55368->55371 55473 7ff60f181c50 86 API calls 55369->55473 55376 7ff60f181364 55370->55376 55377 7ff60f181344 55370->55377 55474 7ff60f181c10 86 API calls 55371->55474 55374 7ff60f1812ee 55374->55129 55375 7ff60f181325 55375->55129 55379 7ff60f18137e 55376->55379 55384 7ff60f181395 55376->55384 55475 7ff60f181c10 86 API calls 55377->55475 55455 7ff60f181050 55379->55455 55381 7ff60f181421 55381->55129 55382 7ff60f18e96c _fread_nolock 53 API calls 55382->55384 55383 7ff60f18e61c 74 API calls 55383->55381 55384->55382 55385 7ff60f18135f __std_exception_copy 55384->55385 55386 7ff60f1813de 55384->55386 55385->55381 55385->55383 55476 7ff60f181c10 86 API calls 55386->55476 55388->55121 55389->55121 55390->55129 55391->55121 55392->55121 55393->55121 55395 7ff60f181b30 49 API calls 55394->55395 55396 7ff60f182e90 55395->55396 55396->55303 55398 7ff60f182d7a 55397->55398 55399 7ff60f186dc0 88 API calls 55398->55399 55400 7ff60f182da2 55399->55400 55401 7ff60f18a110 _wfindfirst32i64 8 API calls 55400->55401 55402 7ff60f182dca 55401->55402 55402->55298 55403 7ff60f186320 55402->55403 55404 7ff60f186dc0 88 API calls 55403->55404 55405 7ff60f186337 LoadLibraryExW 55404->55405 55406 7ff60f186354 __std_exception_copy 55405->55406 55406->55298 55407->55300 55408->55304 55409->55306 55410->55300 55411->55300 55416 7ff60f183c3a 55412->55416 55413 7ff60f18a110 _wfindfirst32i64 8 API calls 55415 7ff60f183e10 55413->55415 55442 7ff60f186fc0 88 API calls __std_exception_copy 55415->55442 55417 7ff60f183d53 55416->55417 55420 7ff60f183e29 55416->55420 55438 7ff60f183df1 55416->55438 55444 7ff60f195750 47 API calls 55416->55444 55445 7ff60f181780 86 API calls 55416->55445 55419 7ff60f1992f4 _fread_nolock 37 API calls 55417->55419 55417->55438 55421 7ff60f183d6a 55419->55421 55450 7ff60f181c50 86 API calls 55420->55450 55446 7ff60f19585c 39 API calls 3 library calls 55421->55446 55424 7ff60f183d76 55425 7ff60f1992f4 _fread_nolock 37 API calls 55424->55425 55426 7ff60f183d88 55425->55426 55447 7ff60f19585c 39 API calls 3 library calls 55426->55447 55428 7ff60f183d94 55448 7ff60f195de4 73 API calls 55428->55448 55430 7ff60f183da6 55449 7ff60f195de4 73 API calls 55430->55449 55432 7ff60f183db8 55433 7ff60f194f8c 71 API calls 55432->55433 55434 7ff60f183dc9 55433->55434 55435 7ff60f194f8c 71 API calls 55434->55435 55436 7ff60f183ddd 55435->55436 55437 7ff60f194f8c 71 API calls 55436->55437 55437->55438 55438->55413 55439->55321 55440->55329 55441->55340 55442->55345 55443->55333 55444->55416 55445->55416 55446->55424 55447->55428 55448->55430 55449->55432 55450->55438 55451->55351 55452->55355 55453->55355 55454->55360 55456 7ff60f1810a6 55455->55456 55457 7ff60f1810ad 55456->55457 55458 7ff60f1810d3 55456->55458 55477 7ff60f181c50 86 API calls 55457->55477 55461 7ff60f1810ed 55458->55461 55462 7ff60f181109 55458->55462 55460 7ff60f1810c0 55460->55385 55478 7ff60f181c10 86 API calls 55461->55478 55464 7ff60f18111b 55462->55464 55471 7ff60f181137 memcpy_s 55462->55471 55479 7ff60f181c10 86 API calls 55464->55479 55466 7ff60f18e96c _fread_nolock 53 API calls 55466->55471 55467 7ff60f181104 __std_exception_copy 55467->55385 55468 7ff60f1811fe 55481 7ff60f181c50 86 API calls 55468->55481 55471->55466 55471->55467 55471->55468 55472 7ff60f18e6e0 37 API calls 55471->55472 55480 7ff60f18f0ac 76 API calls 55471->55480 55472->55471 55473->55374 55474->55375 55475->55385 55476->55385 55477->55460 55478->55467 55479->55467 55480->55471 55481->55467 55483 7ff60f181dd6 55482->55483 55484 7ff60f181b30 49 API calls 55483->55484 55486 7ff60f181e0b 55484->55486 55485 7ff60f182211 55486->55485 55487 7ff60f182c50 49 API calls 55486->55487 55488 7ff60f181e7f 55487->55488 55540 7ff60f182230 55488->55540 55491 7ff60f181efa 55494 7ff60f182230 75 API calls 55491->55494 55492 7ff60f181ec1 55548 7ff60f185880 127 API calls 55492->55548 55496 7ff60f181f4c 55494->55496 55495 7ff60f181ec9 55497 7ff60f181eea 55495->55497 55549 7ff60f185760 138 API calls 2 library calls 55495->55549 55498 7ff60f181fb6 55496->55498 55499 7ff60f181f50 55496->55499 55504 7ff60f181ef3 55497->55504 55552 7ff60f181c50 86 API calls 55497->55552 55502 7ff60f182230 75 API calls 55498->55502 55550 7ff60f185880 127 API calls 55499->55550 55505 7ff60f181fe2 55502->55505 55510 7ff60f18a110 _wfindfirst32i64 8 API calls 55504->55510 55507 7ff60f182042 55505->55507 55511 7ff60f182230 75 API calls 55505->55511 55506 7ff60f181f58 55506->55497 55551 7ff60f185760 138 API calls 2 library calls 55506->55551 55507->55485 55553 7ff60f185880 127 API calls 55507->55553 55513 7ff60f181fab 55510->55513 55514 7ff60f182012 55511->55514 55512 7ff60f181f75 55512->55497 55515 7ff60f1821f6 55512->55515 55513->55138 55514->55507 55516 7ff60f182230 75 API calls 55514->55516 55557 7ff60f181c50 86 API calls 55515->55557 55516->55507 55517 7ff60f181af0 86 API calls 55520 7ff60f1820af 55517->55520 55519 7ff60f182052 55519->55485 55519->55517 55529 7ff60f18216f 55519->55529 55520->55485 55522 7ff60f181b30 49 API calls 55520->55522 55523 7ff60f1820d7 55522->55523 55523->55515 55525 7ff60f181b30 49 API calls 55523->55525 55524 7ff60f1821db 55524->55515 55556 7ff60f181440 158 API calls 2 library calls 55524->55556 55526 7ff60f182104 55525->55526 55526->55515 55528 7ff60f181b30 49 API calls 55526->55528 55530 7ff60f182131 55528->55530 55529->55524 55555 7ff60f181780 86 API calls 55529->55555 55530->55515 55532 7ff60f1817b0 121 API calls 55530->55532 55533 7ff60f182153 55532->55533 55533->55529 55534 7ff60f182157 55533->55534 55554 7ff60f181c50 86 API calls 55534->55554 55536 7ff60f18216a 55558 7ff60f181ab0 74 API calls __std_exception_copy 55536->55558 55537->55138 55538->55134 55539->55138 55541 7ff60f182264 55540->55541 55559 7ff60f193c90 55541->55559 55544 7ff60f18229b 55546 7ff60f18a110 _wfindfirst32i64 8 API calls 55544->55546 55547 7ff60f181ebd 55546->55547 55547->55491 55547->55492 55548->55495 55549->55497 55550->55506 55551->55512 55552->55504 55553->55519 55554->55536 55555->55529 55556->55524 55557->55536 55558->55485 55561 7ff60f193cea 55559->55561 55560 7ff60f193d0f 55594 7ff60f199e54 37 API calls 2 library calls 55560->55594 55561->55560 55562 7ff60f193d4b 55561->55562 55595 7ff60f1916d4 49 API calls _invalid_parameter_noinfo 55562->55595 55565 7ff60f193d39 55568 7ff60f18a110 _wfindfirst32i64 8 API calls 55565->55568 55566 7ff60f193e28 55567 7ff60f199f88 __free_lconv_mon 11 API calls 55566->55567 55567->55565 55570 7ff60f18228a 55568->55570 55569 7ff60f193de2 55569->55566 55571 7ff60f193e4c 55569->55571 55572 7ff60f193dfd 55569->55572 55573 7ff60f193df4 55569->55573 55570->55544 55577 7ff60f194e80 55570->55577 55571->55566 55574 7ff60f193e56 55571->55574 55596 7ff60f199f88 55572->55596 55573->55566 55573->55572 55576 7ff60f199f88 __free_lconv_mon 11 API calls 55574->55576 55576->55565 55578 7ff60f194ea9 55577->55578 55579 7ff60f194e9d 55577->55579 55628 7ff60f194a94 45 API calls __CxxCallCatchBlock 55578->55628 55603 7ff60f1946f8 55579->55603 55582 7ff60f194ed1 55586 7ff60f194ee1 55582->55586 55629 7ff60f19e154 5 API calls __crtLCMapStringW 55582->55629 55585 7ff60f194f39 55587 7ff60f194f51 55585->55587 55588 7ff60f194f3d 55585->55588 55630 7ff60f19457c 14 API calls 3 library calls 55586->55630 55590 7ff60f1946f8 69 API calls 55587->55590 55589 7ff60f194ea2 55588->55589 55591 7ff60f199f88 __free_lconv_mon 11 API calls 55588->55591 55589->55544 55592 7ff60f194f5d 55590->55592 55591->55589 55592->55589 55593 7ff60f199f88 __free_lconv_mon 11 API calls 55592->55593 55593->55589 55594->55565 55595->55569 55597 7ff60f199fbc 55596->55597 55598 7ff60f199f8d HeapFree 55596->55598 55597->55565 55598->55597 55599 7ff60f199fa8 GetLastError 55598->55599 55600 7ff60f199fb5 __free_lconv_mon 55599->55600 55602 7ff60f196098 11 API calls _wfindfirst32i64 55600->55602 55602->55597 55604 7ff60f19472f 55603->55604 55605 7ff60f194712 55603->55605 55604->55605 55607 7ff60f194742 CreateFileW 55604->55607 55657 7ff60f196078 11 API calls _wfindfirst32i64 55605->55657 55608 7ff60f194776 55607->55608 55609 7ff60f1947ac 55607->55609 55631 7ff60f19484c GetFileType 55608->55631 55660 7ff60f194d70 46 API calls 2 library calls 55609->55660 55610 7ff60f194717 55658 7ff60f196098 11 API calls _wfindfirst32i64 55610->55658 55615 7ff60f1947b1 55619 7ff60f1947e0 55615->55619 55620 7ff60f1947b5 55615->55620 55616 7ff60f19471f 55659 7ff60f199f20 37 API calls _invalid_parameter_noinfo 55616->55659 55617 7ff60f1947a1 CloseHandle 55622 7ff60f19472a 55617->55622 55618 7ff60f19478b CloseHandle 55618->55622 55662 7ff60f194b30 55619->55662 55661 7ff60f19600c 11 API calls 2 library calls 55620->55661 55622->55589 55625 7ff60f1947bf 55625->55622 55628->55582 55629->55586 55630->55585 55632 7ff60f194957 55631->55632 55633 7ff60f19489a 55631->55633 55634 7ff60f19495f 55632->55634 55635 7ff60f194981 55632->55635 55636 7ff60f1948c6 GetFileInformationByHandle 55633->55636 55680 7ff60f194c6c 21 API calls _fread_nolock 55633->55680 55637 7ff60f194972 GetLastError 55634->55637 55638 7ff60f194963 55634->55638 55640 7ff60f1949a4 PeekNamedPipe 55635->55640 55646 7ff60f194942 55635->55646 55636->55637 55639 7ff60f1948ef 55636->55639 55683 7ff60f19600c 11 API calls 2 library calls 55637->55683 55682 7ff60f196098 11 API calls _wfindfirst32i64 55638->55682 55644 7ff60f194b30 51 API calls 55639->55644 55640->55646 55642 7ff60f1948b4 55642->55636 55642->55646 55647 7ff60f1948fa 55644->55647 55648 7ff60f18a110 _wfindfirst32i64 8 API calls 55646->55648 55673 7ff60f1949f4 55647->55673 55649 7ff60f194784 55648->55649 55649->55617 55649->55618 55652 7ff60f1949f4 10 API calls 55653 7ff60f194919 55652->55653 55654 7ff60f1949f4 10 API calls 55653->55654 55655 7ff60f19492a 55654->55655 55655->55646 55681 7ff60f196098 11 API calls _wfindfirst32i64 55655->55681 55657->55610 55658->55616 55660->55615 55661->55625 55664 7ff60f194b58 55662->55664 55663 7ff60f1947ed 55672 7ff60f194c6c 21 API calls _fread_nolock 55663->55672 55664->55663 55684 7ff60f19e704 51 API calls 2 library calls 55664->55684 55666 7ff60f194bec 55666->55663 55685 7ff60f19e704 51 API calls 2 library calls 55666->55685 55668 7ff60f194bff 55668->55663 55686 7ff60f19e704 51 API calls 2 library calls 55668->55686 55670 7ff60f194c12 55670->55663 55687 7ff60f19e704 51 API calls 2 library calls 55670->55687 55672->55625 55674 7ff60f194a10 55673->55674 55675 7ff60f194a1d FileTimeToSystemTime 55673->55675 55674->55675 55678 7ff60f194a18 55674->55678 55676 7ff60f194a31 SystemTimeToTzSpecificLocalTime 55675->55676 55675->55678 55676->55678 55677 7ff60f18a110 _wfindfirst32i64 8 API calls 55679 7ff60f194909 55677->55679 55678->55677 55679->55652 55680->55642 55681->55646 55682->55646 55683->55646 55684->55666 55685->55668 55686->55670 55687->55663 55688->55149 55691 7ff60f19547c 55690->55691 55692 7ff60f1954a2 55691->55692 55695 7ff60f1954d5 55691->55695 55721 7ff60f196098 11 API calls _wfindfirst32i64 55692->55721 55694 7ff60f1954a7 55722 7ff60f199f20 37 API calls _invalid_parameter_noinfo 55694->55722 55697 7ff60f1954e8 55695->55697 55698 7ff60f1954db 55695->55698 55709 7ff60f19a268 55697->55709 55723 7ff60f196098 11 API calls _wfindfirst32i64 55698->55723 55702 7ff60f182e39 55702->55160 55703 7ff60f195509 55716 7ff60f19f52c 55703->55716 55704 7ff60f1954fc 55724 7ff60f196098 11 API calls _wfindfirst32i64 55704->55724 55707 7ff60f19551c 55725 7ff60f1943a8 LeaveCriticalSection 55707->55725 55726 7ff60f19f818 EnterCriticalSection 55709->55726 55711 7ff60f19a27f 55712 7ff60f19a2dc 19 API calls 55711->55712 55713 7ff60f19a28a 55712->55713 55714 7ff60f19f878 _isindst LeaveCriticalSection 55713->55714 55715 7ff60f1954f2 55714->55715 55715->55703 55715->55704 55727 7ff60f19f228 55716->55727 55719 7ff60f19f586 55719->55707 55721->55694 55723->55702 55724->55702 55728 7ff60f19f263 __vcrt_FlsAlloc 55727->55728 55737 7ff60f19f42a 55728->55737 55742 7ff60f1a5504 51 API calls 3 library calls 55728->55742 55730 7ff60f19f501 55746 7ff60f199f20 37 API calls _invalid_parameter_noinfo 55730->55746 55732 7ff60f19f433 55732->55719 55739 7ff60f1a61ec 55732->55739 55734 7ff60f19f495 55734->55737 55743 7ff60f1a5504 51 API calls 3 library calls 55734->55743 55736 7ff60f19f4b4 55736->55737 55744 7ff60f1a5504 51 API calls 3 library calls 55736->55744 55737->55732 55745 7ff60f196098 11 API calls _wfindfirst32i64 55737->55745 55747 7ff60f1a57ec 55739->55747 55742->55734 55743->55736 55744->55737 55745->55730 55748 7ff60f1a5821 55747->55748 55749 7ff60f1a5803 55747->55749 55748->55749 55752 7ff60f1a583d 55748->55752 55801 7ff60f196098 11 API calls _wfindfirst32i64 55749->55801 55751 7ff60f1a5808 55802 7ff60f199f20 37 API calls _invalid_parameter_noinfo 55751->55802 55758 7ff60f1a5dfc 55752->55758 55756 7ff60f1a5814 55756->55719 55804 7ff60f1a5b30 55758->55804 55761 7ff60f1a5e71 55835 7ff60f196078 11 API calls _wfindfirst32i64 55761->55835 55762 7ff60f1a5e89 55823 7ff60f196e70 55762->55823 55765 7ff60f1a5e76 55836 7ff60f196098 11 API calls _wfindfirst32i64 55765->55836 55793 7ff60f1a5868 55793->55756 55803 7ff60f196e48 LeaveCriticalSection 55793->55803 55801->55751 55805 7ff60f1a5b5c 55804->55805 55813 7ff60f1a5b76 55804->55813 55805->55813 55848 7ff60f196098 11 API calls _wfindfirst32i64 55805->55848 55807 7ff60f1a5b6b 55849 7ff60f199f20 37 API calls _invalid_parameter_noinfo 55807->55849 55809 7ff60f1a5c45 55817 7ff60f1a5ca2 55809->55817 55854 7ff60f1957ec 37 API calls 2 library calls 55809->55854 55810 7ff60f1a5bf4 55810->55809 55852 7ff60f196098 11 API calls _wfindfirst32i64 55810->55852 55813->55810 55850 7ff60f196098 11 API calls _wfindfirst32i64 55813->55850 55814 7ff60f1a5c9e 55814->55817 55855 7ff60f199f40 IsProcessorFeaturePresent 55814->55855 55815 7ff60f1a5c3a 55853 7ff60f199f20 37 API calls _invalid_parameter_noinfo 55815->55853 55817->55761 55817->55762 55819 7ff60f1a5be9 55851 7ff60f199f20 37 API calls _invalid_parameter_noinfo 55819->55851 55860 7ff60f19f818 EnterCriticalSection 55823->55860 55835->55765 55836->55793 55848->55807 55850->55819 55852->55815 55854->55814 55856 7ff60f199f53 55855->55856 55859 7ff60f199c54 14 API calls 2 library calls 55856->55859 55858 7ff60f199f6e GetCurrentProcess TerminateProcess 55859->55858 55862 7ff60f197adc 55861->55862 55865 7ff60f1975b8 55862->55865 55864 7ff60f197af5 55864->55170 55866 7ff60f197602 55865->55866 55867 7ff60f1975d3 55865->55867 55875 7ff60f19439c EnterCriticalSection 55866->55875 55876 7ff60f199e54 37 API calls 2 library calls 55867->55876 55870 7ff60f1975f3 55870->55864 55871 7ff60f197607 55872 7ff60f197624 38 API calls 55871->55872 55873 7ff60f197613 55872->55873 55874 7ff60f1943a8 _fread_nolock LeaveCriticalSection 55873->55874 55874->55870 55876->55870 55878 7ff60f18e441 55877->55878 55879 7ff60f18e413 55877->55879 55881 7ff60f18e433 55878->55881 55887 7ff60f19439c EnterCriticalSection 55878->55887 55888 7ff60f199e54 37 API calls 2 library calls 55879->55888 55881->55174 55883 7ff60f18e458 55884 7ff60f18e474 72 API calls 55883->55884 55885 7ff60f18e464 55884->55885 55886 7ff60f1943a8 _fread_nolock LeaveCriticalSection 55885->55886 55886->55881 55888->55881 55889 7ff60f19e96c 55890 7ff60f19eb5e 55889->55890 55892 7ff60f19e9ae _isindst 55889->55892 55935 7ff60f196098 11 API calls _wfindfirst32i64 55890->55935 55892->55890 55895 7ff60f19ea2e _isindst 55892->55895 55893 7ff60f18a110 _wfindfirst32i64 8 API calls 55894 7ff60f19eb79 55893->55894 55910 7ff60f1a5444 55895->55910 55900 7ff60f19eb8a 55902 7ff60f199f40 _wfindfirst32i64 17 API calls 55900->55902 55904 7ff60f19eb9e 55902->55904 55907 7ff60f19ea8b 55909 7ff60f19eb4e 55907->55909 55934 7ff60f1a5488 37 API calls _isindst 55907->55934 55909->55893 55911 7ff60f19ea4c 55910->55911 55912 7ff60f1a5453 55910->55912 55916 7ff60f1a4848 55911->55916 55936 7ff60f19f818 EnterCriticalSection 55912->55936 55914 7ff60f1a545b 55914->55911 55915 7ff60f1a52b4 55 API calls 55914->55915 55915->55911 55917 7ff60f1a4851 55916->55917 55918 7ff60f19ea61 55916->55918 55937 7ff60f196098 11 API calls _wfindfirst32i64 55917->55937 55918->55900 55922 7ff60f1a4878 55918->55922 55920 7ff60f1a4856 55938 7ff60f199f20 37 API calls _invalid_parameter_noinfo 55920->55938 55923 7ff60f1a4881 55922->55923 55924 7ff60f19ea72 55922->55924 55939 7ff60f196098 11 API calls _wfindfirst32i64 55923->55939 55924->55900 55928 7ff60f1a48a8 55924->55928 55926 7ff60f1a4886 55940 7ff60f199f20 37 API calls _invalid_parameter_noinfo 55926->55940 55929 7ff60f1a48b1 55928->55929 55933 7ff60f19ea83 55928->55933 55941 7ff60f196098 11 API calls _wfindfirst32i64 55929->55941 55931 7ff60f1a48b6 55942 7ff60f199f20 37 API calls _invalid_parameter_noinfo 55931->55942 55933->55900 55933->55907 55934->55909 55935->55909 55937->55920 55939->55926 55941->55931

                                    Executed Functions

                                    Function 00007FFE13271000 Relevance: 307.1, APIs: 10, Strings: 165, Instructions: 859networkCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 0 7ffe13271000-7ffe13271044 WSAStartup 1 7ffe13274144-7ffe1327414c 0->1 2 7ffe1327104a-7ffe13271064 00007FFDFB5BC3F0 0->2 3 7ffe13274181 1->3 4 7ffe1327414e-7ffe13274151 1->4 5 7ffe1327106a-7ffe132710f1 call 7ffe13273da2 VerSetConditionMask * 3 VerifyVersionInfoW 2->5 6 7ffe132710f7-7ffe1327111d call 7ffe13279390 2->6 11 7ffe13274188-7ffe13274198 call 7ffe132794d8 3->11 7 7ffe13274153-7ffe13274156 4->7 8 7ffe13274178-7ffe1327417f 4->8 5->6 18 7ffe13271123-7ffe13271177 call 7ffe13279348 call 7ffe13279398 6->18 19 7ffe132720e6-7ffe132720e8 6->19 7->3 12 7ffe13274158-7ffe13274172 call 7ffe132794b0 7->12 8->11 12->8 18->19 28 7ffe1327117d-7ffe132711b7 call 7ffe13279348 call 7ffe13279398 18->28 21 7ffe132720b3-7ffe132720dd call 7ffe13272af0 19->21 28->19 33 7ffe132711bd-7ffe132711f7 call 7ffe13279348 call 7ffe13279398 28->33 33->19 38 7ffe132711fd-7ffe1327123a call 7ffe13279348 * 2 33->38 38->19 43 7ffe13271240-7ffe13271260 call 7ffe13279348 38->43 43->19 46 7ffe13271266-7ffe132712ac call 7ffe13279348 call 7ffe132793c0 call 7ffe13279348 43->46 46->19 53 7ffe132712b2-7ffe13271f38 call 7ffe13279580 * 144 46->53 342 7ffe13271f3b-7ffe13271f46 call 7ffe132794c0 53->342 342->19 345 7ffe13271f4c-7ffe13271f6a call 7ffe13279348 342->345 345->342 348 7ffe13271f6c-7ffe13271fda call 7ffe13279580 * 4 call 7ffe13279528 call 7ffe13279328 345->348 361 7ffe132720b0 348->361 362 7ffe13271fe0-7ffe13272045 call 7ffe13273da2 VerSetConditionMask * 3 348->362 361->21 365 7ffe13272048-7ffe13272063 VerifyVersionInfoA 362->365 366 7ffe13272065-7ffe13272087 call 7ffe132793f8 365->366 367 7ffe132720a8 365->367 370 7ffe1327209d-7ffe132720a6 366->370 371 7ffe13272089-7ffe1327209b call 7ffe13279458 366->371 367->361 370->365 370->367 371->370 374 7ffe132720de-7ffe132720e4 call 7ffe132793a0 371->374 374->370
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692291900.00007FFE13271000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFE13270000, based on PE: true
                                    • Associated: 00000002.00000002.1692276597.00007FFE13270000.00000002.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13281000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13283000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13286000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692354101.00007FFE13287000.00000080.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692369518.00007FFE13288000.00000004.00000001.01000000.00000007.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13270000_run0796.jbxd
                                    Similarity
                                    • API ID: ConditionMask$InfoVerifyVersion$00007Startup
                                    • String ID: AF_APPLETALK$AF_DECnet$AF_INET$AF_INET6$AF_IPX$AF_IRDA$AF_SNA$AF_UNSPEC$AI_ADDRCONFIG$AI_ALL$AI_CANONNAME$AI_NUMERICHOST$AI_NUMERICSERV$AI_PASSIVE$AI_V4MAPPED$CAPI$EAI_AGAIN$EAI_BADFLAGS$EAI_FAIL$EAI_FAMILY$EAI_MEMORY$EAI_NODATA$EAI_NONAME$EAI_SERVICE$EAI_SOCKTYPE$INADDR_ALLHOSTS_GROUP$INADDR_ANY$INADDR_BROADCAST$INADDR_LOOPBACK$INADDR_MAX_LOCAL_GROUP$INADDR_NONE$INADDR_UNSPEC_GROUP$IPPORT_RESERVED$IPPORT_USERRESERVED$IPPROTO_AH$IPPROTO_CBT$IPPROTO_DSTOPTS$IPPROTO_EGP$IPPROTO_ESP$IPPROTO_FRAGMENT$IPPROTO_GGP$IPPROTO_HOPOPTS$IPPROTO_ICLFXBM$IPPROTO_ICMP$IPPROTO_ICMPV6$IPPROTO_IDP$IPPROTO_IGMP$IPPROTO_IGP$IPPROTO_IP$IPPROTO_IPV4$IPPROTO_IPV6$IPPROTO_L2TP$IPPROTO_MAX$IPPROTO_ND$IPPROTO_NONE$IPPROTO_PGM$IPPROTO_PIM$IPPROTO_PUP$IPPROTO_RAW$IPPROTO_RDP$IPPROTO_ROUTING$IPPROTO_SCTP$IPPROTO_ST$IPPROTO_TCP$IPPROTO_UDP$IPV6_CHECKSUM$IPV6_DONTFRAG$IPV6_HOPLIMIT$IPV6_HOPOPTS$IPV6_JOIN_GROUP$IPV6_LEAVE_GROUP$IPV6_MULTICAST_HOPS$IPV6_MULTICAST_IF$IPV6_MULTICAST_LOOP$IPV6_PKTINFO$IPV6_RECVRTHDR$IPV6_RECVTCLASS$IPV6_RTHDR$IPV6_TCLASS$IPV6_UNICAST_HOPS$IPV6_V6ONLY$IP_ADD_MEMBERSHIP$IP_DROP_MEMBERSHIP$IP_HDRINCL$IP_MULTICAST_IF$IP_MULTICAST_LOOP$IP_MULTICAST_TTL$IP_OPTIONS$IP_RECVDSTADDR$IP_TOS$IP_TTL$MSG_BCAST$MSG_CTRUNC$MSG_DONTROUTE$MSG_ERRQUEUE$MSG_MCAST$MSG_OOB$MSG_PEEK$MSG_TRUNC$MSG_WAITALL$NI_DGRAM$NI_MAXHOST$NI_MAXSERV$NI_NAMEREQD$NI_NOFQDN$NI_NUMERICHOST$NI_NUMERICSERV$RCVALL_MAX$RCVALL_OFF$RCVALL_ON$RCVALL_SOCKETLEVELONLY$SHUT_RD$SHUT_RDWR$SHUT_WR$SIO_KEEPALIVE_VALS$SIO_LOOPBACK_FAST_PATH$SIO_RCVALL$SOCK_DGRAM$SOCK_RAW$SOCK_RDM$SOCK_SEQPACKET$SOCK_STREAM$SOL_IP$SOL_SOCKET$SOL_TCP$SOL_UDP$SOMAXCONN$SO_ACCEPTCONN$SO_BROADCAST$SO_DEBUG$SO_DONTROUTE$SO_ERROR$SO_EXCLUSIVEADDRUSE$SO_KEEPALIVE$SO_LINGER$SO_OOBINLINE$SO_RCVBUF$SO_RCVLOWAT$SO_RCVTIMEO$SO_REUSEADDR$SO_SNDBUF$SO_SNDLOWAT$SO_SNDTIMEO$SO_TYPE$SO_USELOOPBACK$SocketType$TCP_FASTOPEN$TCP_KEEPCNT$TCP_KEEPIDLE$TCP_KEEPINTVL$TCP_MAXSEG$TCP_NODELAY$WSAStartup failed: error code %d$WSAStartup failed: network not ready$WSAStartup failed: requested version not supported$_socket.CAPI$error$gaierror$has_ipv6$herror$socket$socket.gaierror$socket.herror$socket.timeout$timeout
                                    • API String ID: 1562806975-1455933423
                                    • Opcode ID: 3c0f611dac04d412b27ab9a6ceaeaa59a29a38cd1241e2a0695555b645f1dcec
                                    • Instruction ID: 7d319e37c8d54b854c457e4c61da63536ac2c521e3736ac4bed8fdd285268682
                                    • Opcode Fuzzy Hash: 3c0f611dac04d412b27ab9a6ceaeaa59a29a38cd1241e2a0695555b645f1dcec
                                    • Instruction Fuzzy Hash: ECA2CC64B18F1299EA14AF27E8556A42371BBFABE1F4450B5CC0E67774EE7DE108C700
                                    Function 00007FF60F1A4EB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334timeCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 487 7ff60f1a4eb0-7ff60f1a4eeb call 7ff60f1a4838 call 7ff60f1a4840 call 7ff60f1a48a8 494 7ff60f1a4ef1-7ff60f1a4efc call 7ff60f1a4848 487->494 495 7ff60f1a5115-7ff60f1a5161 call 7ff60f199f40 call 7ff60f1a4838 call 7ff60f1a4840 call 7ff60f1a48a8 487->495 494->495 501 7ff60f1a4f02-7ff60f1a4f0c 494->501 522 7ff60f1a529f-7ff60f1a530d call 7ff60f199f40 call 7ff60f1a0748 495->522 523 7ff60f1a5167-7ff60f1a5172 call 7ff60f1a4848 495->523 503 7ff60f1a4f2e-7ff60f1a4f32 501->503 504 7ff60f1a4f0e-7ff60f1a4f11 501->504 506 7ff60f1a4f35-7ff60f1a4f3d 503->506 505 7ff60f1a4f14-7ff60f1a4f1f 504->505 508 7ff60f1a4f21-7ff60f1a4f28 505->508 509 7ff60f1a4f2a-7ff60f1a4f2c 505->509 506->506 510 7ff60f1a4f3f-7ff60f1a4f52 call 7ff60f19cc3c 506->510 508->505 508->509 509->503 512 7ff60f1a4f5b-7ff60f1a4f69 509->512 517 7ff60f1a4f54-7ff60f1a4f56 call 7ff60f199f88 510->517 518 7ff60f1a4f6a-7ff60f1a4f76 call 7ff60f199f88 510->518 517->512 528 7ff60f1a4f7d-7ff60f1a4f85 518->528 541 7ff60f1a530f-7ff60f1a5316 522->541 542 7ff60f1a531b-7ff60f1a531e 522->542 523->522 532 7ff60f1a5178-7ff60f1a5183 call 7ff60f1a4878 523->532 528->528 531 7ff60f1a4f87-7ff60f1a4f98 call 7ff60f19f9b4 528->531 531->495 539 7ff60f1a4f9e-7ff60f1a4ff4 call 7ff60f18b890 * 4 call 7ff60f1a4dcc 531->539 532->522 540 7ff60f1a5189-7ff60f1a51ac call 7ff60f199f88 GetTimeZoneInformation 532->540 599 7ff60f1a4ff6-7ff60f1a4ffa 539->599 555 7ff60f1a51b2-7ff60f1a51d3 540->555 556 7ff60f1a5274-7ff60f1a529e call 7ff60f1a4830 call 7ff60f1a4820 call 7ff60f1a4828 540->556 545 7ff60f1a53ab-7ff60f1a53ae 541->545 546 7ff60f1a5320 542->546 547 7ff60f1a5355-7ff60f1a5368 call 7ff60f19cc3c 542->547 551 7ff60f1a5323 545->551 552 7ff60f1a53b4-7ff60f1a53bc call 7ff60f1a4eb0 545->552 546->551 560 7ff60f1a5373-7ff60f1a538e call 7ff60f1a0748 547->560 561 7ff60f1a536a 547->561 557 7ff60f1a5328-7ff60f1a5354 call 7ff60f199f88 call 7ff60f18a110 551->557 558 7ff60f1a5323 call 7ff60f1a512c 551->558 552->557 563 7ff60f1a51de-7ff60f1a51e5 555->563 564 7ff60f1a51d5-7ff60f1a51db 555->564 558->557 583 7ff60f1a5390-7ff60f1a5393 560->583 584 7ff60f1a5395-7ff60f1a53a7 call 7ff60f199f88 560->584 568 7ff60f1a536c-7ff60f1a5371 call 7ff60f199f88 561->568 571 7ff60f1a51e7-7ff60f1a51ef 563->571 572 7ff60f1a51f9 563->572 564->563 568->546 571->572 578 7ff60f1a51f1-7ff60f1a51f7 571->578 579 7ff60f1a51fb-7ff60f1a526f call 7ff60f18b890 * 4 call 7ff60f1a1d0c call 7ff60f1a53c4 * 2 572->579 578->579 579->556 583->568 584->545 602 7ff60f1a5000-7ff60f1a5004 599->602 603 7ff60f1a4ffc 599->603 602->599 604 7ff60f1a5006-7ff60f1a502b call 7ff60f1a7cf4 602->604 603->602 610 7ff60f1a502e-7ff60f1a5032 604->610 612 7ff60f1a5041-7ff60f1a5045 610->612 613 7ff60f1a5034-7ff60f1a503f 610->613 612->610 613->612 615 7ff60f1a5047-7ff60f1a504b 613->615 617 7ff60f1a504d-7ff60f1a5075 call 7ff60f1a7cf4 615->617 618 7ff60f1a50cc-7ff60f1a50d0 615->618 627 7ff60f1a5093-7ff60f1a5097 617->627 628 7ff60f1a5077 617->628 620 7ff60f1a50d2-7ff60f1a50d4 618->620 621 7ff60f1a50d7-7ff60f1a50e4 618->621 620->621 623 7ff60f1a50ff-7ff60f1a510e call 7ff60f1a4830 call 7ff60f1a4820 621->623 624 7ff60f1a50e6-7ff60f1a50fc call 7ff60f1a4dcc 621->624 623->495 624->623 627->618 633 7ff60f1a5099-7ff60f1a50b7 call 7ff60f1a7cf4 627->633 631 7ff60f1a507a-7ff60f1a5081 628->631 631->627 634 7ff60f1a5083-7ff60f1a5091 631->634 639 7ff60f1a50c3-7ff60f1a50ca 633->639 634->627 634->631 639->618 640 7ff60f1a50b9-7ff60f1a50bd 639->640 640->618 641 7ff60f1a50bf 640->641 641->639
                                    APIs
                                    • _get_daylight.LIBCMT ref: 00007FF60F1A4EF5
                                      • Part of subcall function 00007FF60F1A4848: _invalid_parameter_noinfo.LIBCMT ref: 00007FF60F1A485C
                                      • Part of subcall function 00007FF60F199F88: HeapFree.KERNEL32(?,?,?,00007FF60F1A1ED2,?,?,?,00007FF60F1A1F0F,?,?,00000000,00007FF60F1A23D5,?,?,00000000,00007FF60F1A2307), ref: 00007FF60F199F9E
                                      • Part of subcall function 00007FF60F199F88: GetLastError.KERNEL32(?,?,?,00007FF60F1A1ED2,?,?,?,00007FF60F1A1F0F,?,?,00000000,00007FF60F1A23D5,?,?,00000000,00007FF60F1A2307), ref: 00007FF60F199FA8
                                      • Part of subcall function 00007FF60F199F40: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF60F199F1F,?,?,?,?,?,00007FF60F191A50), ref: 00007FF60F199F49
                                      • Part of subcall function 00007FF60F199F40: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF60F199F1F,?,?,?,?,?,00007FF60F191A50), ref: 00007FF60F199F6E
                                    • _get_daylight.LIBCMT ref: 00007FF60F1A4EE4
                                      • Part of subcall function 00007FF60F1A48A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF60F1A48BC
                                    • _get_daylight.LIBCMT ref: 00007FF60F1A515A
                                    • _get_daylight.LIBCMT ref: 00007FF60F1A516B
                                    • _get_daylight.LIBCMT ref: 00007FF60F1A517C
                                    • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF60F1A53BC), ref: 00007FF60F1A51A3
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1691492610.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000002.00000002.1691469586.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691519836.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691591884.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
                                    • String ID: Eastern Standard Time$Eastern Summer Time
                                    • API String ID: 4070488512-239921721
                                    • Opcode ID: 694ad2a23735cc7fb3f2ec8971a6aa60c063a628b57b9edeeabbe946f82a905d
                                    • Instruction ID: 71f9883345d5a7dadbebb44a9de875d8e6fdd5626254157d273668a8dbe434fd
                                    • Opcode Fuzzy Hash: 694ad2a23735cc7fb3f2ec8971a6aa60c063a628b57b9edeeabbe946f82a905d
                                    • Instruction Fuzzy Hash: 02D1E136E1C24286EB24DF26E9401B977A1FF84B84F6440BAEA1DC7695DF7CE445C780
                                    Function 00007FF60F1A5DFC Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 684 7ff60f1a5dfc-7ff60f1a5e6f call 7ff60f1a5b30 687 7ff60f1a5e71-7ff60f1a5e7a call 7ff60f196078 684->687 688 7ff60f1a5e89-7ff60f1a5e93 call 7ff60f196e70 684->688 693 7ff60f1a5e7d-7ff60f1a5e84 call 7ff60f196098 687->693 694 7ff60f1a5eae-7ff60f1a5f17 CreateFileW 688->694 695 7ff60f1a5e95-7ff60f1a5eac call 7ff60f196078 call 7ff60f196098 688->695 708 7ff60f1a61ca-7ff60f1a61ea 693->708 696 7ff60f1a5f94-7ff60f1a5f9f GetFileType 694->696 697 7ff60f1a5f19-7ff60f1a5f1f 694->697 695->693 703 7ff60f1a5fa1-7ff60f1a5fdc GetLastError call 7ff60f19600c CloseHandle 696->703 704 7ff60f1a5ff2-7ff60f1a5ff9 696->704 700 7ff60f1a5f61-7ff60f1a5f8f GetLastError call 7ff60f19600c 697->700 701 7ff60f1a5f21-7ff60f1a5f25 697->701 700->693 701->700 706 7ff60f1a5f27-7ff60f1a5f5f CreateFileW 701->706 703->693 719 7ff60f1a5fe2-7ff60f1a5fed call 7ff60f196098 703->719 711 7ff60f1a6001-7ff60f1a6004 704->711 712 7ff60f1a5ffb-7ff60f1a5fff 704->712 706->696 706->700 713 7ff60f1a6006 711->713 714 7ff60f1a600a-7ff60f1a605f call 7ff60f196d88 711->714 712->714 713->714 722 7ff60f1a607e-7ff60f1a60af call 7ff60f1a58b0 714->722 723 7ff60f1a6061-7ff60f1a606d call 7ff60f1a5d38 714->723 719->693 730 7ff60f1a60b1-7ff60f1a60b3 722->730 731 7ff60f1a60b5-7ff60f1a60f7 722->731 723->722 729 7ff60f1a606f 723->729 734 7ff60f1a6071-7ff60f1a6079 call 7ff60f19a100 729->734 730->734 732 7ff60f1a6119-7ff60f1a6124 731->732 733 7ff60f1a60f9-7ff60f1a60fd 731->733 736 7ff60f1a61c8 732->736 737 7ff60f1a612a-7ff60f1a612e 732->737 733->732 735 7ff60f1a60ff-7ff60f1a6114 733->735 734->708 735->732 736->708 737->736 739 7ff60f1a6134-7ff60f1a6179 CloseHandle CreateFileW 737->739 741 7ff60f1a61ae-7ff60f1a61c3 739->741 742 7ff60f1a617b-7ff60f1a61a9 GetLastError call 7ff60f19600c call 7ff60f196fb0 739->742 741->736 742->741
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1691492610.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000002.00000002.1691469586.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691519836.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691591884.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                    • String ID:
                                    • API String ID: 1617910340-0
                                    • Opcode ID: f4a66a793454549687445e322010bf0c8aa55a7819c853dce57e356f604717af
                                    • Instruction ID: 5f932c4cff2a71ab5cbf149a0b3041c08d873aefc0bebfa0fc401b973b4db778
                                    • Opcode Fuzzy Hash: f4a66a793454549687445e322010bf0c8aa55a7819c853dce57e356f604717af
                                    • Instruction Fuzzy Hash: ACC1DF32B2CA4285EB10CFA4C5906BC37B1FB49BA8B250275DE2E97795DF39E459C340
                                    Function 00007FF60F1A512C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 1126 7ff60f1a512c-7ff60f1a5161 call 7ff60f1a4838 call 7ff60f1a4840 call 7ff60f1a48a8 1133 7ff60f1a529f-7ff60f1a530d call 7ff60f199f40 call 7ff60f1a0748 1126->1133 1134 7ff60f1a5167-7ff60f1a5172 call 7ff60f1a4848 1126->1134 1146 7ff60f1a530f-7ff60f1a5316 1133->1146 1147 7ff60f1a531b-7ff60f1a531e 1133->1147 1134->1133 1140 7ff60f1a5178-7ff60f1a5183 call 7ff60f1a4878 1134->1140 1140->1133 1145 7ff60f1a5189-7ff60f1a51ac call 7ff60f199f88 GetTimeZoneInformation 1140->1145 1157 7ff60f1a51b2-7ff60f1a51d3 1145->1157 1158 7ff60f1a5274-7ff60f1a529e call 7ff60f1a4830 call 7ff60f1a4820 call 7ff60f1a4828 1145->1158 1149 7ff60f1a53ab-7ff60f1a53ae 1146->1149 1150 7ff60f1a5320 1147->1150 1151 7ff60f1a5355-7ff60f1a5368 call 7ff60f19cc3c 1147->1151 1154 7ff60f1a5323 1149->1154 1155 7ff60f1a53b4-7ff60f1a53bc call 7ff60f1a4eb0 1149->1155 1150->1154 1162 7ff60f1a5373-7ff60f1a538e call 7ff60f1a0748 1151->1162 1163 7ff60f1a536a 1151->1163 1159 7ff60f1a5328-7ff60f1a5354 call 7ff60f199f88 call 7ff60f18a110 1154->1159 1160 7ff60f1a5323 call 7ff60f1a512c 1154->1160 1155->1159 1164 7ff60f1a51de-7ff60f1a51e5 1157->1164 1165 7ff60f1a51d5-7ff60f1a51db 1157->1165 1160->1159 1182 7ff60f1a5390-7ff60f1a5393 1162->1182 1183 7ff60f1a5395-7ff60f1a53a7 call 7ff60f199f88 1162->1183 1169 7ff60f1a536c-7ff60f1a5371 call 7ff60f199f88 1163->1169 1171 7ff60f1a51e7-7ff60f1a51ef 1164->1171 1172 7ff60f1a51f9 1164->1172 1165->1164 1169->1150 1171->1172 1177 7ff60f1a51f1-7ff60f1a51f7 1171->1177 1178 7ff60f1a51fb-7ff60f1a526f call 7ff60f18b890 * 4 call 7ff60f1a1d0c call 7ff60f1a53c4 * 2 1172->1178 1177->1178 1178->1158 1182->1169 1183->1149
                                    APIs
                                    • _get_daylight.LIBCMT ref: 00007FF60F1A515A
                                      • Part of subcall function 00007FF60F1A48A8: _invalid_parameter_noinfo.LIBCMT ref: 00007FF60F1A48BC
                                    • _get_daylight.LIBCMT ref: 00007FF60F1A516B
                                      • Part of subcall function 00007FF60F1A4848: _invalid_parameter_noinfo.LIBCMT ref: 00007FF60F1A485C
                                    • _get_daylight.LIBCMT ref: 00007FF60F1A517C
                                      • Part of subcall function 00007FF60F1A4878: _invalid_parameter_noinfo.LIBCMT ref: 00007FF60F1A488C
                                      • Part of subcall function 00007FF60F199F88: HeapFree.KERNEL32(?,?,?,00007FF60F1A1ED2,?,?,?,00007FF60F1A1F0F,?,?,00000000,00007FF60F1A23D5,?,?,00000000,00007FF60F1A2307), ref: 00007FF60F199F9E
                                      • Part of subcall function 00007FF60F199F88: GetLastError.KERNEL32(?,?,?,00007FF60F1A1ED2,?,?,?,00007FF60F1A1F0F,?,?,00000000,00007FF60F1A23D5,?,?,00000000,00007FF60F1A2307), ref: 00007FF60F199FA8
                                    • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF60F1A53BC), ref: 00007FF60F1A51A3
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1691492610.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000002.00000002.1691469586.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691519836.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691591884.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
                                    • String ID: Eastern Standard Time$Eastern Summer Time
                                    • API String ID: 3458911817-239921721
                                    • Opcode ID: aa908a3e8f59a2679ecf24881337d3af3797adb0d4fc4d825233bf145dabf6f9
                                    • Instruction ID: 38acbc584f84989e3b486e51793f3560ec2cf114bad2888dcdcd7cf93dea3b5f
                                    • Opcode Fuzzy Hash: aa908a3e8f59a2679ecf24881337d3af3797adb0d4fc4d825233bf145dabf6f9
                                    • Instruction Fuzzy Hash: 93518D32A1C64286E710DF22E9801B9B7A1FF88784F6455BAEA5DC37A6DF3CE405C740
                                    Function 00007FFE13287170 Relevance: 6.9, APIs: 4, Instructions: 889librarymemoryloaderCOMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692354101.00007FFE13287000.00000080.00000001.01000000.00000007.sdmp, Offset: 00007FFE13270000, based on PE: true
                                    • Associated: 00000002.00000002.1692276597.00007FFE13270000.00000002.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13271000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13281000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13283000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13286000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692369518.00007FFE13288000.00000004.00000001.01000000.00000007.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13270000_run0796.jbxd
                                    Similarity
                                    • API ID: ProtectVirtual$AddressLibraryLoadProc
                                    • String ID:
                                    • API String ID: 3300690313-0
                                    • Opcode ID: eb1ed757e0c0d0017b7bbfa9539dfb41ce8016755be030351fe7973ce086d168
                                    • Instruction ID: 20547a64e02322e82c995dbf308a9dafbfefe9b848a171bfcc468f3a7b5eba52
                                    • Opcode Fuzzy Hash: eb1ed757e0c0d0017b7bbfa9539dfb41ce8016755be030351fe7973ce086d168
                                    • Instruction Fuzzy Hash: 20628A226289928AE315DF3DD4002BD77E1F7A8395F045171EA9ED3BD4EA3CEA91C700
                                    Function 00007FFE148EAB70 Relevance: 6.9, APIs: 4, Instructions: 889librarymemoryloaderCOMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692543814.00007FFE148EA000.00000080.00000001.01000000.00000008.sdmp, Offset: 00007FFE148E0000, based on PE: true
                                    • Associated: 00000002.00000002.1692469000.00007FFE148E0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                    • Associated: 00000002.00000002.1692491940.00007FFE148E1000.00000040.00000001.01000000.00000008.sdmpDownload File
                                    • Associated: 00000002.00000002.1692491940.00007FFE148E9000.00000040.00000001.01000000.00000008.sdmpDownload File
                                    • Associated: 00000002.00000002.1692562185.00007FFE148EC000.00000004.00000001.01000000.00000008.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe148e0000_run0796.jbxd
                                    Similarity
                                    • API ID: ProtectVirtual$AddressLibraryLoadProc
                                    • String ID:
                                    • API String ID: 3300690313-0
                                    • Opcode ID: 5dae28dba6e705b0fe2cf0c7c3d7d264b9ae2b0064efb0e88754277e5b651d6b
                                    • Instruction ID: cdeab95fee911c5d2c4882c661b5b48a74c213599f7e84f52f32246644f931a3
                                    • Opcode Fuzzy Hash: 5dae28dba6e705b0fe2cf0c7c3d7d264b9ae2b0064efb0e88754277e5b651d6b
                                    • Instruction Fuzzy Hash: D062782262899286E715CF3AD48037DB7A0F749795F045132FA9ED37E4EA3CEA49C710
                                    Function 00007FF60F1817B0 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 144COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1691492610.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000002.00000002.1691469586.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691519836.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691591884.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: _fread_nolock$_invalid_parameter_noinfo
                                    • String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
                                    • API String ID: 3405171723-4158440160
                                    • Opcode ID: 770c135d7a320c110b34b208cc8bb55b9606d2930a950d8cbf931880d73878f1
                                    • Instruction ID: f42261027cbde2e239c9811e22ddacf527898e21de98bad1e435bd04293adab8
                                    • Opcode Fuzzy Hash: 770c135d7a320c110b34b208cc8bb55b9606d2930a950d8cbf931880d73878f1
                                    • Instruction Fuzzy Hash: 16514D72A0DA4296EB54CF29D55127833A0FF48B88B608576DA0DD7399DFBCE446C740
                                    Function 00007FF60F1812B0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 106COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1691492610.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000002.00000002.1691469586.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691519836.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691591884.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                    • API String ID: 0-3659356012
                                    • Opcode ID: 851645ae4d8e2ba64e8fa848f09866995ef5c47b6c3ea5c2ee8fd1dd56a41fac
                                    • Instruction ID: 8deb96ac6ee62c849a446c0bca842eb6476daea894413d8d5ef3604aeb3d8c17
                                    • Opcode Fuzzy Hash: 851645ae4d8e2ba64e8fa848f09866995ef5c47b6c3ea5c2ee8fd1dd56a41fac
                                    • Instruction Fuzzy Hash: FC418E32B0CA4292EA24DB11E9006BA63A0FF54BD0F644472DE4D97B55EFBCE547C700
                                    Function 00007FF60F181000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 274COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 810 7ff60f181000-7ff60f1827b6 call 7ff60f18e3f0 call 7ff60f18e3e8 call 7ff60f1867d0 call 7ff60f18a140 call 7ff60f194320 call 7ff60f194f8c call 7ff60f181af0 826 7ff60f1827bc-7ff60f1827cb call 7ff60f182cd0 810->826 827 7ff60f1828ca 810->827 826->827 832 7ff60f1827d1-7ff60f1827e4 call 7ff60f182ba0 826->832 829 7ff60f1828cf-7ff60f1828ef call 7ff60f18a110 827->829 832->827 836 7ff60f1827ea-7ff60f1827fd call 7ff60f182c50 832->836 836->827 839 7ff60f182803-7ff60f18282a call 7ff60f185af0 836->839 842 7ff60f18286c-7ff60f182894 call 7ff60f186100 call 7ff60f1819d0 839->842 843 7ff60f18282c-7ff60f18283b call 7ff60f185af0 839->843 853 7ff60f18297d-7ff60f18298e 842->853 854 7ff60f18289a-7ff60f1828b0 call 7ff60f1819d0 842->854 843->842 849 7ff60f18283d-7ff60f182843 843->849 851 7ff60f182845-7ff60f18284d 849->851 852 7ff60f18284f-7ff60f182869 call 7ff60f194148 call 7ff60f186100 849->852 851->852 852->842 858 7ff60f1829a3-7ff60f1829bb call 7ff60f186dc0 853->858 859 7ff60f182990-7ff60f18299a call 7ff60f1824a0 853->859 865 7ff60f1828b2-7ff60f1828c5 call 7ff60f181c50 854->865 866 7ff60f1828f0-7ff60f1828f3 854->866 871 7ff60f1829bd-7ff60f1829c9 call 7ff60f181c50 858->871 872 7ff60f1829ce-7ff60f1829d5 SetDllDirectoryW 858->872 869 7ff60f18299c 859->869 870 7ff60f1829db-7ff60f1829e8 call 7ff60f184fa0 859->870 865->827 866->853 874 7ff60f1828f9-7ff60f182910 call 7ff60f182de0 866->874 869->858 883 7ff60f1829ea-7ff60f1829fa call 7ff60f184c40 870->883 884 7ff60f182a36-7ff60f182a3b call 7ff60f184f20 870->884 871->827 872->870 881 7ff60f182917-7ff60f182943 call 7ff60f186370 874->881 882 7ff60f182912-7ff60f182915 874->882 893 7ff60f18296d-7ff60f18297b 881->893 894 7ff60f182945-7ff60f18294d call 7ff60f18e61c 881->894 885 7ff60f182952-7ff60f182968 call 7ff60f181c50 882->885 883->884 898 7ff60f1829fc-7ff60f182a0b call 7ff60f1847a0 883->898 891 7ff60f182a40-7ff60f182a43 884->891 885->827 896 7ff60f182a49-7ff60f182a56 891->896 897 7ff60f182af6-7ff60f182afe call 7ff60f182330 891->897 893->859 894->885 901 7ff60f182a60-7ff60f182a6a 896->901 904 7ff60f182b03-7ff60f182b05 897->904 910 7ff60f182a0d-7ff60f182a19 call 7ff60f184720 898->910 911 7ff60f182a2c-7ff60f182a31 call 7ff60f1849f0 898->911 906 7ff60f182a6c-7ff60f182a71 901->906 907 7ff60f182a73-7ff60f182a75 901->907 904->827 912 7ff60f182b0b-7ff60f182b42 call 7ff60f186090 call 7ff60f185af0 call 7ff60f184530 904->912 906->901 906->907 908 7ff60f182a77-7ff60f182a9a call 7ff60f181b30 907->908 909 7ff60f182ac1-7ff60f182acc call 7ff60f182490 call 7ff60f1822d0 907->909 908->827 922 7ff60f182aa0-7ff60f182aab 908->922 929 7ff60f182ad1-7ff60f182af1 call 7ff60f182480 call 7ff60f1849f0 call 7ff60f184f20 909->929 910->911 923 7ff60f182a1b-7ff60f182a2a call 7ff60f184df0 910->923 911->884 912->827 935 7ff60f182b48-7ff60f182b7d call 7ff60f182490 call 7ff60f186140 call 7ff60f1849f0 call 7ff60f184f20 912->935 926 7ff60f182ab0-7ff60f182abf 922->926 923->891 926->909 926->926 929->829 948 7ff60f182b87-7ff60f182b91 call 7ff60f181ab0 935->948 949 7ff60f182b7f-7ff60f182b82 call 7ff60f185e00 935->949 948->829 949->948
                                    APIs
                                      • Part of subcall function 00007FF60F182CD0: GetModuleFileNameW.KERNEL32(?,00007FF60F1827C9,?,?,?,?,?,?), ref: 00007FF60F182D01
                                    • SetDllDirectoryW.KERNEL32 ref: 00007FF60F1829D5
                                      • Part of subcall function 00007FF60F185AF0: GetEnvironmentVariableW.KERNEL32(00007FF60F182817,?,?,?,?,?,?), ref: 00007FF60F185B2A
                                      • Part of subcall function 00007FF60F185AF0: ExpandEnvironmentStringsW.KERNEL32(?,?,?,?,?,?), ref: 00007FF60F185B47
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1691492610.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000002.00000002.1691469586.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691519836.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691591884.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
                                    • String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
                                    • API String ID: 2344891160-3602715111
                                    • Opcode ID: 0192c57c939c35f0e6dbe9ed0ee8818f80c439c90b295c49350d1662e1304eab
                                    • Instruction ID: d514e8a73e6732a384ea52bb459570d788e1907a290763abd1bfb07f5b3b84b9
                                    • Opcode Fuzzy Hash: 0192c57c939c35f0e6dbe9ed0ee8818f80c439c90b295c49350d1662e1304eab
                                    • Instruction Fuzzy Hash: 9BC18031A1C6C351EA65AB22DA602FD6391FF44784F6040B2EA4DC769AEFBCE507C740
                                    Function 00007FF60F181050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 953 7ff60f181050-7ff60f1810ab call 7ff60f1899a0 956 7ff60f1810ad-7ff60f1810d2 call 7ff60f181c50 953->956 957 7ff60f1810d3-7ff60f1810eb call 7ff60f19415c 953->957 962 7ff60f1810ed-7ff60f181104 call 7ff60f181c10 957->962 963 7ff60f181109-7ff60f181119 call 7ff60f19415c 957->963 968 7ff60f18126c-7ff60f1812a0 call 7ff60f189680 call 7ff60f194148 * 2 962->968 969 7ff60f18111b-7ff60f181132 call 7ff60f181c10 963->969 970 7ff60f181137-7ff60f181147 963->970 969->968 972 7ff60f181150-7ff60f18116d call 7ff60f18e96c 970->972 977 7ff60f181172-7ff60f181175 972->977 979 7ff60f18117b-7ff60f181185 call 7ff60f18e6e0 977->979 980 7ff60f18125e 977->980 979->980 987 7ff60f18118b-7ff60f181197 979->987 982 7ff60f181264 980->982 982->968 988 7ff60f1811a0-7ff60f1811c8 call 7ff60f187df0 987->988 991 7ff60f1811ca-7ff60f1811cd 988->991 992 7ff60f181241-7ff60f18125c call 7ff60f181c50 988->992 994 7ff60f18123c 991->994 995 7ff60f1811cf-7ff60f1811d9 991->995 992->982 994->992 997 7ff60f1811db-7ff60f1811f0 call 7ff60f18f0ac 995->997 998 7ff60f181203-7ff60f181206 995->998 1005 7ff60f1811f2-7ff60f1811fc call 7ff60f18e6e0 997->1005 1006 7ff60f1811fe-7ff60f181201 997->1006 1000 7ff60f181219-7ff60f18121e 998->1000 1001 7ff60f181208-7ff60f181216 call 7ff60f18aed0 998->1001 1000->988 1004 7ff60f181220-7ff60f181223 1000->1004 1001->1000 1008 7ff60f181237-7ff60f18123a 1004->1008 1009 7ff60f181225-7ff60f181228 1004->1009 1005->1000 1005->1006 1006->992 1008->982 1009->992 1011 7ff60f18122a-7ff60f181232 1009->1011 1011->972
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1691492610.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000002.00000002.1691469586.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691519836.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691591884.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: 1.2.13$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                    • API String ID: 0-1655038675
                                    • Opcode ID: 2a578be33031fd32cf3abfa5031e8686f84481d48ef04cad4200493a6f643d0e
                                    • Instruction ID: 46cb2c0f7f1e4877a94a88e9b6ae2abcc918e7b4cbe2e38dc3143f0962339492
                                    • Opcode Fuzzy Hash: 2a578be33031fd32cf3abfa5031e8686f84481d48ef04cad4200493a6f643d0e
                                    • Instruction Fuzzy Hash: 9151CA32A0C68291EA609B51E5403BA6391FB85B94F7441B6EE4ED7785EF7CE407C700
                                    Function 00007FF60F19B09C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 1013 7ff60f19b09c-7ff60f19b0c2 1014 7ff60f19b0c4-7ff60f19b0d8 call 7ff60f196078 call 7ff60f196098 1013->1014 1015 7ff60f19b0dd-7ff60f19b0e1 1013->1015 1029 7ff60f19b4ce 1014->1029 1016 7ff60f19b4b7-7ff60f19b4c3 call 7ff60f196078 call 7ff60f196098 1015->1016 1017 7ff60f19b0e7-7ff60f19b0ee 1015->1017 1036 7ff60f19b4c9 call 7ff60f199f20 1016->1036 1017->1016 1019 7ff60f19b0f4-7ff60f19b122 1017->1019 1019->1016 1023 7ff60f19b128-7ff60f19b12f 1019->1023 1026 7ff60f19b131-7ff60f19b143 call 7ff60f196078 call 7ff60f196098 1023->1026 1027 7ff60f19b148-7ff60f19b14b 1023->1027 1026->1036 1032 7ff60f19b151-7ff60f19b157 1027->1032 1033 7ff60f19b4b3-7ff60f19b4b5 1027->1033 1034 7ff60f19b4d1-7ff60f19b4e8 1029->1034 1032->1033 1037 7ff60f19b15d-7ff60f19b160 1032->1037 1033->1034 1036->1029 1037->1026 1040 7ff60f19b162-7ff60f19b187 1037->1040 1042 7ff60f19b189-7ff60f19b18b 1040->1042 1043 7ff60f19b1ba-7ff60f19b1c1 1040->1043 1044 7ff60f19b1b2-7ff60f19b1b8 1042->1044 1045 7ff60f19b18d-7ff60f19b194 1042->1045 1046 7ff60f19b1c3-7ff60f19b1eb call 7ff60f19cc3c call 7ff60f199f88 * 2 1043->1046 1047 7ff60f19b196-7ff60f19b1ad call 7ff60f196078 call 7ff60f196098 call 7ff60f199f20 1043->1047 1049 7ff60f19b238-7ff60f19b24f 1044->1049 1045->1044 1045->1047 1073 7ff60f19b208-7ff60f19b233 call 7ff60f19b8c4 1046->1073 1074 7ff60f19b1ed-7ff60f19b203 call 7ff60f196098 call 7ff60f196078 1046->1074 1077 7ff60f19b340 1047->1077 1052 7ff60f19b251-7ff60f19b259 1049->1052 1053 7ff60f19b2ca-7ff60f19b2d4 call 7ff60f1a2acc 1049->1053 1052->1053 1057 7ff60f19b25b-7ff60f19b25d 1052->1057 1064 7ff60f19b35e 1053->1064 1065 7ff60f19b2da-7ff60f19b2ef 1053->1065 1057->1053 1061 7ff60f19b25f-7ff60f19b275 1057->1061 1061->1053 1066 7ff60f19b277-7ff60f19b283 1061->1066 1069 7ff60f19b363-7ff60f19b383 ReadFile 1064->1069 1065->1064 1071 7ff60f19b2f1-7ff60f19b303 GetConsoleMode 1065->1071 1066->1053 1072 7ff60f19b285-7ff60f19b287 1066->1072 1075 7ff60f19b389-7ff60f19b391 1069->1075 1076 7ff60f19b47d-7ff60f19b486 GetLastError 1069->1076 1071->1064 1078 7ff60f19b305-7ff60f19b30d 1071->1078 1072->1053 1079 7ff60f19b289-7ff60f19b2a1 1072->1079 1073->1049 1074->1077 1075->1076 1082 7ff60f19b397 1075->1082 1085 7ff60f19b4a3-7ff60f19b4a6 1076->1085 1086 7ff60f19b488-7ff60f19b49e call 7ff60f196098 call 7ff60f196078 1076->1086 1087 7ff60f19b343-7ff60f19b34d call 7ff60f199f88 1077->1087 1078->1069 1084 7ff60f19b30f-7ff60f19b331 ReadConsoleW 1078->1084 1079->1053 1080 7ff60f19b2a3-7ff60f19b2af 1079->1080 1080->1053 1088 7ff60f19b2b1-7ff60f19b2b3 1080->1088 1092 7ff60f19b39e-7ff60f19b3b3 1082->1092 1094 7ff60f19b333 GetLastError 1084->1094 1095 7ff60f19b352-7ff60f19b35c 1084->1095 1089 7ff60f19b339-7ff60f19b33b call 7ff60f19600c 1085->1089 1090 7ff60f19b4ac-7ff60f19b4ae 1085->1090 1086->1077 1087->1034 1088->1053 1099 7ff60f19b2b5-7ff60f19b2c5 1088->1099 1089->1077 1090->1087 1092->1087 1101 7ff60f19b3b5-7ff60f19b3c0 1092->1101 1094->1089 1095->1092 1099->1053 1105 7ff60f19b3c2-7ff60f19b3db call 7ff60f19acb4 1101->1105 1106 7ff60f19b3e7-7ff60f19b3ef 1101->1106 1113 7ff60f19b3e0-7ff60f19b3e2 1105->1113 1110 7ff60f19b3f1-7ff60f19b403 1106->1110 1111 7ff60f19b46b-7ff60f19b478 call 7ff60f19aaf4 1106->1111 1114 7ff60f19b45e-7ff60f19b466 1110->1114 1115 7ff60f19b405 1110->1115 1111->1113 1113->1087 1114->1087 1117 7ff60f19b40a-7ff60f19b411 1115->1117 1118 7ff60f19b413-7ff60f19b417 1117->1118 1119 7ff60f19b44d-7ff60f19b458 1117->1119 1120 7ff60f19b433 1118->1120 1121 7ff60f19b419-7ff60f19b420 1118->1121 1119->1114 1123 7ff60f19b439-7ff60f19b449 1120->1123 1121->1120 1122 7ff60f19b422-7ff60f19b426 1121->1122 1122->1120 1124 7ff60f19b428-7ff60f19b431 1122->1124 1123->1117 1125 7ff60f19b44b 1123->1125 1124->1123 1125->1114
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1691492610.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000002.00000002.1691469586.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691519836.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691591884.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: _invalid_parameter_noinfo
                                    • String ID:
                                    • API String ID: 3215553584-0
                                    • Opcode ID: 5a4d685ae9cce30cf93841342e5a1d314e29f636783538e3b5adbfb391e49450
                                    • Instruction ID: fef5076ae37b6f82f7bcfceba3c113fc18604a0db98855059d893e79d8f2cdd4
                                    • Opcode Fuzzy Hash: 5a4d685ae9cce30cf93841342e5a1d314e29f636783538e3b5adbfb391e49450
                                    • Instruction Fuzzy Hash: 1CC10332A0C68791E760CB55A4402BD3BA1EFD1B80F7901B9DA4E83791CF7DEA498380
                                    Function 00007FFE01388980 Relevance: 7.6, APIs: 5, Instructions: 134COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 1203 7ffe01388980-7ffe01388992 1204 7ffe013889a8-7ffe013889ad call 7ffe013c25e4 1203->1204 1205 7ffe01388994-7ffe013889c8 1203->1205 1204->1205 1209 7ffe013889ce-7ffe013889d1 1205->1209 1210 7ffe01388af1-7ffe01388af9 1205->1210 1213 7ffe01388ac7-7ffe01388ace call 7ffe013c1a18 1209->1213 1214 7ffe013889d7-7ffe013889da 1209->1214 1211 7ffe01388afb-7ffe01388b06 1210->1211 1212 7ffe01388a8d-7ffe01388a9e 1210->1212 1215 7ffe013c85b6-7ffe013c85c4 call 7ffe013e8f48 1211->1215 1216 7ffe01388b0c-7ffe01388b13 1211->1216 1213->1212 1231 7ffe01388ad0-7ffe01388adc call 7ffe013c2694 call 7ffe01387504 1213->1231 1218 7ffe01388a9f-7ffe01388aa2 1214->1218 1219 7ffe013889e0-7ffe013889f1 GetLastError 1214->1219 1215->1212 1237 7ffe013c85ca 1215->1237 1220 7ffe01388ac0-7ffe01388ac5 1216->1220 1221 7ffe01388b15-7ffe01388b1c call 7ffe013859bc 1216->1221 1218->1212 1222 7ffe01388aa4-7ffe01388aad 1218->1222 1225 7ffe01388a0a-7ffe01388a15 call 7ffe01388b20 1219->1225 1226 7ffe013889f3-7ffe013889fe call 7ffe0138d4d0 1219->1226 1220->1212 1221->1220 1243 7ffe013c855c-7ffe013c8572 call 7ffe01388b20 call 7ffe0139a280 1221->1243 1222->1220 1229 7ffe01388aaf-7ffe01388aba call 7ffe0138d4d0 1222->1229 1241 7ffe01388a1b-7ffe01388a3b call 7ffe0138e040 1225->1241 1242 7ffe013c8599-7ffe013c85a1 SetLastError 1225->1242 1239 7ffe013c8577-7ffe013c857b 1226->1239 1240 7ffe01388a04 1226->1240 1229->1220 1229->1243 1254 7ffe01388ae1-7ffe01388ae3 1231->1254 1237->1237 1239->1242 1247 7ffe013c857d 1239->1247 1240->1225 1258 7ffe013c8588-7ffe013c8594 call 7ffe01388b20 call 7ffe013980a4 1241->1258 1259 7ffe01388a41-7ffe01388a4b call 7ffe01388b20 1241->1259 1250 7ffe013c85a9-7ffe013c85b1 call 7ffe013c1a50 1242->1250 1243->1220 1252 7ffe01388a60-7ffe01388a63 1247->1252 1250->1212 1252->1242 1255 7ffe01388a69-7ffe01388a89 call 7ffe0138d4d0 SetLastError 1252->1255 1254->1250 1256 7ffe01388ae9-7ffe01388aef 1254->1256 1255->1212 1256->1220 1258->1242 1269 7ffe013c8582 1259->1269 1270 7ffe01388a51-7ffe01388a5b call 7ffe01389b80 call 7ffe0138e510 1259->1270 1269->1258 1270->1252
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: ErrorLast
                                    • String ID:
                                    • API String ID: 1452528299-0
                                    • Opcode ID: 56ab15ebf88d2f472214260ccf3aa2794fd81f93f1b441577069300a3873c5fd
                                    • Instruction ID: b443df4d8dcdc0dd49a48a4965e0f4e15b561225be5ce8dd394c4a27ce354162
                                    • Opcode Fuzzy Hash: 56ab15ebf88d2f472214260ccf3aa2794fd81f93f1b441577069300a3873c5fd
                                    • Instruction Fuzzy Hash: FE51D220E0C70382FB54A768A9501BD62A1AF94394F5A46B5E52E5F7FBDF6CFC028301
                                    Function 00007FF60F19E96C Relevance: 6.2, APIs: 4, Instructions: 162COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 1648 7ff60f19e96c-7ff60f19e9a8 1649 7ff60f19eb5e-7ff60f19eb69 call 7ff60f196098 1648->1649 1650 7ff60f19e9ae-7ff60f19e9b7 1648->1650 1655 7ff60f19eb6d-7ff60f19eb89 call 7ff60f18a110 1649->1655 1650->1649 1652 7ff60f19e9bd-7ff60f19e9c6 1650->1652 1652->1649 1654 7ff60f19e9cc-7ff60f19e9cf 1652->1654 1654->1649 1656 7ff60f19e9d5-7ff60f19e9e6 1654->1656 1658 7ff60f19ea10-7ff60f19ea14 1656->1658 1659 7ff60f19e9e8-7ff60f19e9f1 call 7ff60f19e910 1656->1659 1658->1649 1661 7ff60f19ea1a-7ff60f19ea1e 1658->1661 1659->1649 1665 7ff60f19e9f7-7ff60f19e9fa 1659->1665 1661->1649 1664 7ff60f19ea24-7ff60f19ea28 1661->1664 1664->1649 1666 7ff60f19ea2e-7ff60f19ea3e call 7ff60f19e910 1664->1666 1665->1649 1667 7ff60f19ea00-7ff60f19ea03 1665->1667 1671 7ff60f19ea40-7ff60f19ea43 1666->1671 1672 7ff60f19ea47 call 7ff60f1a5444 1666->1672 1667->1649 1669 7ff60f19ea09 1667->1669 1669->1658 1671->1672 1673 7ff60f19ea45 1671->1673 1675 7ff60f19ea4c-7ff60f19ea63 call 7ff60f1a4848 1672->1675 1673->1672 1678 7ff60f19ea69-7ff60f19ea74 call 7ff60f1a4878 1675->1678 1679 7ff60f19eb8a-7ff60f19eb9f call 7ff60f199f40 1675->1679 1678->1679 1684 7ff60f19ea7a-7ff60f19ea85 call 7ff60f1a48a8 1678->1684 1684->1679 1687 7ff60f19ea8b-7ff60f19eb1f 1684->1687 1688 7ff60f19eb21-7ff60f19eb3d 1687->1688 1689 7ff60f19eb59-7ff60f19eb5c 1687->1689 1690 7ff60f19eb3f-7ff60f19eb43 1688->1690 1691 7ff60f19eb54-7ff60f19eb57 1688->1691 1689->1655 1690->1691 1692 7ff60f19eb45-7ff60f19eb50 call 7ff60f1a5488 1690->1692 1691->1655 1692->1691
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1691492610.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000002.00000002.1691469586.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691519836.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691591884.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: _get_daylight$_isindst
                                    • String ID:
                                    • API String ID: 4170891091-0
                                    • Opcode ID: 7c116d52e869d70fe36170fafcd4453455d7a89aa2c255f713b58b82420c40e6
                                    • Instruction ID: d0d0c75ca962e43ef561abd9aadbb6c4e3103ee5c2a1a727d67b03ad8f060a9a
                                    • Opcode Fuzzy Hash: 7c116d52e869d70fe36170fafcd4453455d7a89aa2c255f713b58b82420c40e6
                                    • Instruction Fuzzy Hash: 6651E272F0C2128AFB28DF64D9556BC27A1FB50368F640179EE1F93AE5DF38A4068740
                                    Function 00007FF60F19484C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1691492610.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000002.00000002.1691469586.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691519836.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691591884.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                    • String ID:
                                    • API String ID: 2780335769-0
                                    • Opcode ID: e26be3db5802fbb9384144a92f7734554038aa84eaf5e6a474e4d8e63b6235a5
                                    • Instruction ID: 444c1294c5f1160b661bcbbe8b482cbe7e64b0952d9f5b360a28ba2d96b9fca3
                                    • Opcode Fuzzy Hash: e26be3db5802fbb9384144a92f7734554038aa84eaf5e6a474e4d8e63b6235a5
                                    • Instruction Fuzzy Hash: AD515932E0C6428AFB10DFB1D4613BD23A1EB48B98F248575DE4D97689DF38E486C790
                                    Function 00007FF60F1946F8 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1691492610.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000002.00000002.1691469586.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691519836.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691591884.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                    • String ID:
                                    • API String ID: 1279662727-0
                                    • Opcode ID: 71793c3252844d471d372c4f7c095e38d9e2ed7ddd768de197b20e7bc70de9cb
                                    • Instruction ID: 315dcb31d9b0e207c685762dca199ca53a690e22a81eab77dc2f0040f365addf
                                    • Opcode Fuzzy Hash: 71793c3252844d471d372c4f7c095e38d9e2ed7ddd768de197b20e7bc70de9cb
                                    • Instruction Fuzzy Hash: 4A41BE32E2C78283E754CB61955037973A0FF957A4F209374EA9C83AD6DF7CA5A18780
                                    Function 00007FFE013862A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: FileHandleType
                                    • String ID: @
                                    • API String ID: 3000768030-2766056989
                                    • Opcode ID: 10c4fa39cb729f91123b6bf367b60b64fb3467f7e4e6d2d3a76a5de364945ac9
                                    • Instruction ID: 3225d8ccd30e919c002a3bc46fe17f78cc177e6db27e674c984e36bd84945cc9
                                    • Opcode Fuzzy Hash: 10c4fa39cb729f91123b6bf367b60b64fb3467f7e4e6d2d3a76a5de364945ac9
                                    • Instruction Fuzzy Hash: DD21B462A08B4281EB608B35949113D2A64FB59B74F6A1339DAAF0F7F4CE7DD881D341
                                    Function 00007FF60F18A52C Relevance: 4.6, APIs: 3, Instructions: 102COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1691492610.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000002.00000002.1691469586.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691519836.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691591884.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
                                    • String ID:
                                    • API String ID: 3058843127-0
                                    • Opcode ID: 1be6874be7b06f60d2a206459abee2dcc30803262f01e71d3cdcfcaefe82dc60
                                    • Instruction ID: 46300659b5f5946a15bf2d62f387cebea70d76213ce8a798b1f538a9d432566f
                                    • Opcode Fuzzy Hash: 1be6874be7b06f60d2a206459abee2dcc30803262f01e71d3cdcfcaefe82dc60
                                    • Instruction Fuzzy Hash: B2315C31E0D64393FA54AB2496113B92391EF86B80FB444B6EA0DC72D7DFADE846C740
                                    Function 00007FF60F18E70C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1691492610.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000002.00000002.1691469586.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691519836.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691591884.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: _invalid_parameter_noinfo
                                    • String ID:
                                    • API String ID: 3215553584-0
                                    • Opcode ID: 91f838de0bf1c0634cfb639a0c406c35748c40ae1573d712d08faa75350ec251
                                    • Instruction ID: 2c9de7b3d986d9c0b87a5270586f15a673ab2e5f4a268f5954d2b71e8dea2f59
                                    • Opcode Fuzzy Hash: 91f838de0bf1c0634cfb639a0c406c35748c40ae1573d712d08faa75350ec251
                                    • Instruction Fuzzy Hash: 6C51E731F0D68246FB689AA6960067A6791FF85BA4F284674ED7C837C5CFBCE4028740
                                    Function 00007FF60F19BA58 Relevance: 3.1, APIs: 2, Instructions: 71COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1691492610.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000002.00000002.1691469586.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691519836.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691591884.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: FileHandleType
                                    • String ID:
                                    • API String ID: 3000768030-0
                                    • Opcode ID: ea0bf9139acf7e29816fcd0aba872ae9fa759e19ef548db38860721d431a1d9c
                                    • Instruction ID: 4693968223535430b2a283139e4ba2af16fb3d9f81fc360c706a9ca5afbf5bf3
                                    • Opcode Fuzzy Hash: ea0bf9139acf7e29816fcd0aba872ae9fa759e19ef548db38860721d431a1d9c
                                    • Instruction Fuzzy Hash: ED317E32A1DB4682EB64CB15A5801782750FB85BB0B780379DB6F873E4CF38E5A1D380
                                    Function 00007FF60F19B774 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF60F19B760,00000000,?,?,?,00007FF60F181023,00007FF60F19B869), ref: 00007FF60F19B7C0
                                    • GetLastError.KERNEL32(?,?,?,?,?,00007FF60F19B760,00000000,?,?,?,00007FF60F181023,00007FF60F19B869), ref: 00007FF60F19B7CA
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1691492610.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000002.00000002.1691469586.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691519836.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691591884.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: ErrorFileLastPointer
                                    • String ID:
                                    • API String ID: 2976181284-0
                                    • Opcode ID: 3ffa62e109f94fb18d3b2cbff054a6c81447e1b6aec8cf58aa39285ecb5c62cf
                                    • Instruction ID: 09801d6c33929af24e1aa1a426e59469eb24ec4e748aedba8f3f1a52d4671cf0
                                    • Opcode Fuzzy Hash: 3ffa62e109f94fb18d3b2cbff054a6c81447e1b6aec8cf58aa39285ecb5c62cf
                                    • Instruction Fuzzy Hash: 9211C172A1CA8281DA50CB26B8040A96761EB84BF4F684371EE7D8B7E9CF7CD1558780
                                    Function 00007FF60F1949F4 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON
                                    Download Yara Rule
                                    APIs
                                    • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60F194909), ref: 00007FF60F194A27
                                    • SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF60F194909), ref: 00007FF60F194A3D
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1691492610.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000002.00000002.1691469586.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691519836.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691591884.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: Time$System$FileLocalSpecific
                                    • String ID:
                                    • API String ID: 1707611234-0
                                    • Opcode ID: d262a3a4eaf9c2b0a2efd7598c1d93a89b64667fc18afc5cc579e88e2597d1a8
                                    • Instruction ID: 49ae7d2a00eef2e0c9ebf9e632b68d7616fa4f198033b5122aefb1a7adbbc7cc
                                    • Opcode Fuzzy Hash: d262a3a4eaf9c2b0a2efd7598c1d93a89b64667fc18afc5cc579e88e2597d1a8
                                    • Instruction Fuzzy Hash: DB11A331A1C64282EB64CB11A41103AB7A0FB847B1F700276F6AEC1AD8EF7CE055DB40
                                    Function 00007FF60F19A198 Relevance: 2.6, APIs: 2, Instructions: 59COMMON
                                    Download Yara Rule
                                    APIs
                                    • CloseHandle.KERNELBASE(?,?,?,00007FF60F19A015,?,?,00000000,00007FF60F19A0CA), ref: 00007FF60F19A206
                                    • GetLastError.KERNEL32(?,?,?,00007FF60F19A015,?,?,00000000,00007FF60F19A0CA), ref: 00007FF60F19A210
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1691492610.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000002.00000002.1691469586.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691519836.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691591884.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: CloseErrorHandleLast
                                    • String ID:
                                    • API String ID: 918212764-0
                                    • Opcode ID: 176045b7523cf5febd9284a5f88f2e5d392980a8c79d008abc553eacec4aafb7
                                    • Instruction ID: 25d594e04c43e51d6c9110a1b9e8066ea8bdad2a92605038be5bc247b8567d6b
                                    • Opcode Fuzzy Hash: 176045b7523cf5febd9284a5f88f2e5d392980a8c79d008abc553eacec4aafb7
                                    • Instruction Fuzzy Hash: EA219331F1C68241EA94976195A427D2392EF85BA4F3843B9DA2EC73C5DF6DE4898380
                                    Function 00007FFE013874C0 Relevance: 2.5, APIs: 2, Instructions: 18COMMON
                                    Download Yara Rule
                                    APIs
                                    • EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FFE013874CD
                                      • Part of subcall function 00007FFE013861AC: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FFE01386113), ref: 00007FFE013861D8
                                      • Part of subcall function 00007FFE013861AC: LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00007FFE01386113), ref: 00007FFE0138622D
                                    • LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0 ref: 00007FFE013874F3
                                      • Part of subcall function 00007FFE0138624C: GetStartupInfoW.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0 ref: 00007FFE0138626C
                                      • Part of subcall function 00007FFE013862A0: GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0 ref: 00007FFE013862FC
                                      • Part of subcall function 00007FFE013862A0: GetFileType.KERNELBASE ref: 00007FFE01386312
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: CriticalSection$EnterLeave$FileHandleInfoStartupType
                                    • String ID:
                                    • API String ID: 2762830733-0
                                    • Opcode ID: c868589744674d6913eb51937418dee57fcc5d1debfb9aa775668d33186eab68
                                    • Instruction ID: 0df6f66de50d6f0ae9082177438a260a05f16cd18309b61dac28b55b82fcea87
                                    • Opcode Fuzzy Hash: c868589744674d6913eb51937418dee57fcc5d1debfb9aa775668d33186eab68
                                    • Instruction Fuzzy Hash: 99E01290F196039BFB14BBB19C531BD63249F65356F910030D41DCE1B3DE1DB5898321
                                    Function 00007FF60F19B4EC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1691492610.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000002.00000002.1691469586.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691519836.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691591884.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: _invalid_parameter_noinfo
                                    • String ID:
                                    • API String ID: 3215553584-0
                                    • Opcode ID: 57107eaa3566968eb61c891c6bf60f53c3ecf75195df01cb8ace664919c894e2
                                    • Instruction ID: 875d6026db56458103a3a3e13f6c9f62de1137ed1f086114aacec70ad56b76d1
                                    • Opcode Fuzzy Hash: 57107eaa3566968eb61c891c6bf60f53c3ecf75195df01cb8ace664919c894e2
                                    • Instruction Fuzzy Hash: 0941BE3290C24187FA24CB2AB58427973A0EB96B84F640175DA9EC36D1CF6CE603CB91
                                    Function 00007FF60F186370 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1691492610.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000002.00000002.1691469586.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691519836.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691591884.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: _fread_nolock
                                    • String ID:
                                    • API String ID: 840049012-0
                                    • Opcode ID: 18c58012e19eadf389ff0c619f7667762a4b91089c9f99893196c02b383d4090
                                    • Instruction ID: 24a8f237d244b0ce86e396d75f4f376e80cf4fc57e205123619831d652fd4065
                                    • Opcode Fuzzy Hash: 18c58012e19eadf389ff0c619f7667762a4b91089c9f99893196c02b383d4090
                                    • Instruction Fuzzy Hash: 7A219F31B0C29646FA159B52AA043BAA751FF55BD4FA84071EE4D87786CFBCE842C300
                                    Function 00007FF60F19AF7C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1691492610.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000002.00000002.1691469586.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691519836.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691591884.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: _invalid_parameter_noinfo
                                    • String ID:
                                    • API String ID: 3215553584-0
                                    • Opcode ID: 5c21e00b33c8f2b45ceb84e2d38ad87eb1f0bac44c293c41f89c92cf48f3706b
                                    • Instruction ID: 26762846c0da8f8f61ebf613db41e8509c0858d3aef8516bf71b2f64c99fed9e
                                    • Opcode Fuzzy Hash: 5c21e00b33c8f2b45ceb84e2d38ad87eb1f0bac44c293c41f89c92cf48f3706b
                                    • Instruction Fuzzy Hash: 8C31B272A1C60281F7159B25988137C3760EF80F90F7905B5EA2D833D2DFBDE84587A0
                                    Function 00007FF60F195548 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1691492610.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000002.00000002.1691469586.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691519836.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691591884.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: _invalid_parameter_noinfo
                                    • String ID:
                                    • API String ID: 3215553584-0
                                    • Opcode ID: 25f020cec256df429067bb606d051891f0f83e0bb8faa834007163ccabd97c9c
                                    • Instruction ID: 5095234b5dcf3cd085f843457fb71b1f119317e429a0a901b4a26e17ae72bbaa
                                    • Opcode Fuzzy Hash: 25f020cec256df429067bb606d051891f0f83e0bb8faa834007163ccabd97c9c
                                    • Instruction Fuzzy Hash: 5F11A232A0D64181FAA19F51E40127DA3A1FF95B80F6C44B5EA8CE7B86DF3DE4409B80
                                    Function 00007FF60F1A57EC Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1691492610.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000002.00000002.1691469586.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691519836.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691591884.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: _invalid_parameter_noinfo
                                    • String ID:
                                    • API String ID: 3215553584-0
                                    • Opcode ID: ae9bd99ce62d3538fe7d29b8c80f6b7eb83d48e2b866bc47fbdf5b394f043f57
                                    • Instruction ID: aeb20b0c40d69fa6c1413b5648f7642db8ff016eb3c3343248c7612ec0b0eb36
                                    • Opcode Fuzzy Hash: ae9bd99ce62d3538fe7d29b8c80f6b7eb83d48e2b866bc47fbdf5b394f043f57
                                    • Instruction Fuzzy Hash: 94214232A1CA8187D7618F1AE44037977A1FB84B94F784274E65DC76D9DF3DD4058B40
                                    Function 00007FF60F18E98C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1691492610.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000002.00000002.1691469586.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691519836.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691591884.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: _invalid_parameter_noinfo
                                    • String ID:
                                    • API String ID: 3215553584-0
                                    • Opcode ID: 298f7b2a666c55937c0a4044f00fb88544ba948c427ceaa5fd6043e577695ec0
                                    • Instruction ID: b0da4bfab6f448c846df4b51fe8c0b8a429707375e37a57e278b251b1fbc0516
                                    • Opcode Fuzzy Hash: 298f7b2a666c55937c0a4044f00fb88544ba948c427ceaa5fd6043e577695ec0
                                    • Instruction Fuzzy Hash: 4201C831A0C78241EA44DBA29A01079A791FF86FE0F6846B5EE5C93BD6CFBCD1024300
                                    Function 00007FF60F186320 Relevance: 1.5, APIs: 1, Instructions: 20libraryCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00007FF60F186DC0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?), ref: 00007FF60F186DFA
                                    • LoadLibraryExW.KERNELBASE(?,?,00000000,00007FF60F1822DE,?,?,?,?), ref: 00007FF60F186343
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1691492610.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000002.00000002.1691469586.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691519836.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691591884.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: ByteCharLibraryLoadMultiWide
                                    • String ID:
                                    • API String ID: 2592636585-0
                                    • Opcode ID: 4bdf6301c84a861bdb536e2334b00053543545dc7c114505350ac69f55b0c6e6
                                    • Instruction ID: 7589d92e6f8f238119c2cf82726ba40f7a06ca198de5619a4cc466809aa6f974
                                    • Opcode Fuzzy Hash: 4bdf6301c84a861bdb536e2334b00053543545dc7c114505350ac69f55b0c6e6
                                    • Instruction Fuzzy Hash: 11E0CD31B1C14642DE589767FA0547AA351EF4CFC0B58D035DE0D87755DE3DD4958B00
                                    Function 00007FF60F19DEC8 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • HeapAlloc.KERNEL32(?,?,00000000,00007FF60F19AA26,?,?,?,00007FF60F199BE3,?,?,00000000,00007FF60F199E7E), ref: 00007FF60F19DF1D
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1691492610.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000002.00000002.1691469586.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691519836.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691591884.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: AllocHeap
                                    • String ID:
                                    • API String ID: 4292702814-0
                                    • Opcode ID: 5680686827257c125c79c0b434b54bb6693b4c02053300f6c32a97532040a367
                                    • Instruction ID: 1a55410bf38949abb7873eff166a2fc1a8a8fd5ecbd5bf2b325a4b1535cdf27f
                                    • Opcode Fuzzy Hash: 5680686827257c125c79c0b434b54bb6693b4c02053300f6c32a97532040a367
                                    • Instruction Fuzzy Hash: 00F09074B0D20380FE585761B8523B57390DF55B80F6C54B4C94EC67D2EF2CE48682A0
                                    Function 00007FF60F19CC3C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • HeapAlloc.KERNEL32(?,?,?,00007FF60F18F1F4,?,?,?,00007FF60F190706,?,?,?,?,?,00007FF60F19276D), ref: 00007FF60F19CC7A
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1691492610.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000002.00000002.1691469586.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691519836.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691591884.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: AllocHeap
                                    • String ID:
                                    • API String ID: 4292702814-0
                                    • Opcode ID: b11fc6a16e25d187a1b91613ce7ef6c78f7eee5e93957fcc5bb755ad2e5a5504
                                    • Instruction ID: 8cb9aa4621921c2db3ca6b5f7e82f4e1195e421a59003670a8e8c1afb51a7b95
                                    • Opcode Fuzzy Hash: b11fc6a16e25d187a1b91613ce7ef6c78f7eee5e93957fcc5bb755ad2e5a5504
                                    • Instruction Fuzzy Hash: FCF05870B0D24384FE2496B159512BA2780CF54BB0F280AB4E86EC52C2EF2CA44482E1

                                    Non-executed Functions

                                    Function 00007FFE01385A20 Relevance: 39.0, APIs: 11, Strings: 11, Instructions: 485libraryloaderCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: AddressProc
                                    • String ID: AreFileApisANSI$CompareStringEx$EnumSystemLocalesEx$GetDateFormatEx$GetLocaleInfoEx$GetTimeFormatEx$GetUserDefaultLocaleName$IsValidLocaleName$LCIDToLocaleName$LCMapStringEx$LocaleNameToLCID
                                    • API String ID: 190572456-3252031757
                                    • Opcode ID: e5c01b59c31b06f9d9ddc6d492333062f46c49233acc12ab9cfcc3da049b7148
                                    • Instruction ID: 400e9fc471440a86ba36c67140591e99ce245152c6a400e243f375df5b26520f
                                    • Opcode Fuzzy Hash: e5c01b59c31b06f9d9ddc6d492333062f46c49233acc12ab9cfcc3da049b7148
                                    • Instruction Fuzzy Hash: 4D126365B1EB0346FF198B29E85017963A2AF587C8F495536DC0E8F3B4EE6CE545C301
                                    Function 00007FFE0138B0B0 Relevance: 39.0, APIs: 11, Strings: 11, Instructions: 485COMMONLIBRARYCODE
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: AreFileApisANSI$CompareStringEx$EnumSystemLocalesEx$GetDateFormatEx$GetLocaleInfoEx$GetTimeFormatEx$GetUserDefaultLocaleName$IsValidLocaleName$LCIDToLocaleName$LCMapStringEx$LocaleNameToLCID
                                    • API String ID: 0-3252031757
                                    • Opcode ID: fb8e52c1c90d93fe6c59f15d7ce78a7d005c6badaa9b5647590f3bf837ebe44a
                                    • Instruction ID: f2cfa346998b8ef22c1b52152a76779acf14f2c9bdd3ecf570eaaf7652943fa5
                                    • Opcode Fuzzy Hash: fb8e52c1c90d93fe6c59f15d7ce78a7d005c6badaa9b5647590f3bf837ebe44a
                                    • Instruction Fuzzy Hash: C61264A5B1EB0386FF198729E85017963A2AF487CCF495536DC0E9F7B4EE6CE5458300
                                    Function 00007FFE0138BBB0 Relevance: 30.2, APIs: 16, Strings: 1, Instructions: 464COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,00000000,00007FFE0138B903,?,?,?,00007FFE0138B5CC), ref: 00007FFE0138BD6B
                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,00000000,00007FFE0138B903,?,?,?,00007FFE0138B5CC), ref: 00007FFE0138BDCE
                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,00000000,00007FFE0138B903,?,?,?,00007FFE0138B5CC), ref: 00007FFE0138BEC5
                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,00000000,00007FFE0138B903,?,?,?,00007FFE0138B5CC), ref: 00007FFE0138BF0C
                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,00000000,00007FFE0138B903,?,?,?,00007FFE0138B5CC), ref: 00007FFE0138BF12
                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,00000000,00007FFE0138B903,?,?,?,00007FFE0138B5CC), ref: 00007FFE0138BF59
                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,00000000,00007FFE0138B903,?,?,?,00007FFE0138B5CC), ref: 00007FFE0138BF5F
                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,00000000,00007FFE0138B903,?,?,?,00007FFE0138B5CC), ref: 00007FFE0138BFA6
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: ErrorLast
                                    • String ID: FlsGetValue
                                    • API String ID: 1452528299-662576866
                                    • Opcode ID: 674dc485f50652908af3f8892ada9cedd9e06ff995babca5fe26488da277a0a7
                                    • Instruction ID: 231c51a4f5c69cf2ddb3520bb7e4a1b3f591eea7cc9b637da8067383a1bbad86
                                    • Opcode Fuzzy Hash: 674dc485f50652908af3f8892ada9cedd9e06ff995babca5fe26488da277a0a7
                                    • Instruction Fuzzy Hash: 7B126AB5B09B4386EF258B15D8503BC63A1BF89B98F565136CA1E4F7B5DE3CE8458300
                                    Function 00007FFE132720F0 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 174networkCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692291900.00007FFE13271000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFE13270000, based on PE: true
                                    • Associated: 00000002.00000002.1692276597.00007FFE13270000.00000002.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13281000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13283000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13286000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692354101.00007FFE13287000.00000080.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692369518.00007FFE13288000.00000004.00000001.01000000.00000007.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13270000_run0796.jbxd
                                    Similarity
                                    • API ID: htons$bindhtonlinet_pton
                                    • String ID: %s(): AF_INET address must be tuple, not %.500s$%s(): AF_INET6 address must be tuple, not %.500s$%s(): bad family$%s(): flowinfo must be 0-1048575.$%s(): port must be 0-65535.$O&i;AF_INET address must be a pair (host, port)$O&i|II;AF_INET6 address must be a tuple (host, port[, flowinfo[, scopeid]])$bind$socket.bind
                                    • API String ID: 4011969593-4141199466
                                    • Opcode ID: 1857343c9154eb684f213fb535026925e11d91f3691683735dd1420ce5b7e241
                                    • Instruction ID: 5edbbafe42160efb1e390fcae86da566c2adaedc5e7bd914be7cc168162ec394
                                    • Opcode Fuzzy Hash: 1857343c9154eb684f213fb535026925e11d91f3691683735dd1420ce5b7e241
                                    • Instruction Fuzzy Hash: 36812876B08F5689F710ABA6E4406B923B1BBB9BA8F104172DA4D67A74DE3CE444C740
                                    Function 00007FFE0139195E Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 289COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: ErrorLast
                                    • String ID: FlsGetValue
                                    • API String ID: 1452528299-662576866
                                    • Opcode ID: e2227e03513b00fe38cf432641c1d708b222926280c1054a8c9e815d54820db8
                                    • Instruction ID: 95b5301ae638b7aacefec4b82a82cfe61e9ed5ee65261834639ea5b96574e149
                                    • Opcode Fuzzy Hash: e2227e03513b00fe38cf432641c1d708b222926280c1054a8c9e815d54820db8
                                    • Instruction Fuzzy Hash: 1BD16B72F08B038AFB148B69D4502BC27A1AB447A8F515235DA2D6FBF4EF3CA8418740
                                    Function 00007FF60F1858E0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 141COMMON
                                    Download Yara Rule
                                    APIs
                                    • GetTempPathW.KERNEL32(?,?,00000000,?,?,00007FF60F1858AD), ref: 00007FF60F185977
                                    • GetCurrentProcessId.KERNEL32(?,?,00000000,?,?,00007FF60F1858AD), ref: 00007FF60F18597D
                                      • Part of subcall function 00007FF60F185AF0: GetEnvironmentVariableW.KERNEL32(00007FF60F182817,?,?,?,?,?,?), ref: 00007FF60F185B2A
                                      • Part of subcall function 00007FF60F185AF0: ExpandEnvironmentStringsW.KERNEL32(?,?,?,?,?,?), ref: 00007FF60F185B47
                                      • Part of subcall function 00007FF60F196828: _invalid_parameter_noinfo.LIBCMT ref: 00007FF60F196841
                                    • SetEnvironmentVariableW.KERNEL32(?,?,00000000,?,?,00007FF60F1858AD), ref: 00007FF60F185A31
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1691492610.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000002.00000002.1691469586.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691519836.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691591884.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: Environment$Variable$CurrentExpandPathProcessStringsTemp_invalid_parameter_noinfo
                                    • String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
                                    • API String ID: 1556224225-1116378104
                                    • Opcode ID: 83dbfb4363d8f9f3e4c2f7ad03a46d4d084bda9c9f1d5e6e75e36267100ec64a
                                    • Instruction ID: b6a80f263035e1aabbf44c7e267f313bd9b1f703b08a67b40e5412dddb1ac5e1
                                    • Opcode Fuzzy Hash: 83dbfb4363d8f9f3e4c2f7ad03a46d4d084bda9c9f1d5e6e75e36267100ec64a
                                    • Instruction Fuzzy Hash: 5E517D35B0D65341FE14A722AA912BA5382DF85BD0F6844B1ED0ECB797EF6DE4078340
                                    Function 00007FFE013ABE10 Relevance: 9.4, APIs: 6, Instructions: 398COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: _set_statfp
                                    • String ID:
                                    • API String ID: 1156100317-0
                                    • Opcode ID: 39c15dfeba87cd1253e420539e46141228a28baa41f8b34db465095e72895283
                                    • Instruction ID: ea6998639db605cdf4a38786979b0223ec12c3a4aa5e15b90338b3264b419771
                                    • Opcode Fuzzy Hash: 39c15dfeba87cd1253e420539e46141228a28baa41f8b34db465095e72895283
                                    • Instruction Fuzzy Hash: 1102D622E2DFC589E7678B3554113B6A355AFA63D0F459336ED4E3ABB4DF3CA0428600
                                    Function 00007FFE013AC570 Relevance: 9.3, APIs: 6, Instructions: 255COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: _set_statfp
                                    • String ID:
                                    • API String ID: 1156100317-0
                                    • Opcode ID: 7cc4f378d7ecb9d9b63a5e479f5a8ff09ee885e5740bf5dd47cd3253d2d15eb4
                                    • Instruction ID: 4b6675ce37664558e90940ab081e2779d2d25c15a8a27aa9fbbd36d497da99d5
                                    • Opcode Fuzzy Hash: 7cc4f378d7ecb9d9b63a5e479f5a8ff09ee885e5740bf5dd47cd3253d2d15eb4
                                    • Instruction Fuzzy Hash: 7DA15D21E2DB4649E7678B3644403B69651AF6B7A0F5A9336ED2E3DAF0EF3C74824500
                                    Function 00007FFE013ECC28 Relevance: 9.1, APIs: 6, Instructions: 77COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                    • String ID:
                                    • API String ID: 1239891234-0
                                    • Opcode ID: 9e36f71393d4748cefba426a899f0991de3e69447b84127024d5ca21e32ad54c
                                    • Instruction ID: fbaac6bce35bd26a0c862e53d50c6c90a79aa4c223c9bd96fddc481147e020ba
                                    • Opcode Fuzzy Hash: 9e36f71393d4748cefba426a899f0991de3e69447b84127024d5ca21e32ad54c
                                    • Instruction Fuzzy Hash: E1315276618B8186DB60CF25E4503AE73A4FB88748F550136EB4D4BB69DF7CD145CB40
                                    Function 00007FFE01382B90 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 234COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00007FFE01389EC0: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFE013854DE,?,?,?,00007FFE013853F1,?,?,?,?,?,?,?,00007FFE0138532D), ref: 00007FFE01389EC8
                                      • Part of subcall function 00007FFE01389EC0: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00007FFE013854DE,?,?,?,00007FFE013853F1,?,?,?,?,?,?,?,00007FFE0138532D), ref: 00007FFE01389F50
                                    • GetACP.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(000000B8,000000BC,000001C2,?,?,00007FFE0138A2FE), ref: 00007FFE01382C2D
                                    • IsValidCodePage.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FFE01382C4B
                                    • wcschr.LIBVCRUNTIME ref: 00007FFE01382CF8
                                    • wcschr.LIBVCRUNTIME ref: 00007FFE01382D10
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: ErrorLastwcschr$CodePageValid
                                    • String ID: utf8
                                    • API String ID: 3493387046-905460609
                                    • Opcode ID: a593764df181b41604c3cf35b94b490e2ae2f6175a511466e70b4f786073926a
                                    • Instruction ID: e173fd9aa0af1deff70fac92e647c7ba15555010a432988223b3503c98d8081f
                                    • Opcode Fuzzy Hash: a593764df181b41604c3cf35b94b490e2ae2f6175a511466e70b4f786073926a
                                    • Instruction Fuzzy Hash: 11A1AC72A0878286FB649F21C5412BE27A5FF84788F468131DA5E4B7E5EF3CE655C340
                                    Function 00007FFE013EEFEC Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 114fileCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: Find$File$CloseFirstNext
                                    • String ID: .$.
                                    • API String ID: 3541575487-3769392785
                                    • Opcode ID: 1e680fa196d6dba005587c8f8297efac9c1003dcc7a566ee1bcc1fcb11d647f4
                                    • Instruction ID: 1f7a7d59043835b68384e55681da6d9525debc12c797614854d6354190571e59
                                    • Opcode Fuzzy Hash: 1e680fa196d6dba005587c8f8297efac9c1003dcc7a566ee1bcc1fcb11d647f4
                                    • Instruction Fuzzy Hash: E1412722B1C79184EB60DB66D4046BAA7D5EFA57E4F064132DD1D0F6ECDEBCE8458300
                                    Function 00007FFE013EB4B8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 55COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: InfoLocale
                                    • String ID: ACP$OCP
                                    • API String ID: 2299586839-711371036
                                    • Opcode ID: 5468f287aed247b2ce93be947ce76367776866781d1797c0da89900d9844c3d3
                                    • Instruction ID: 7784f5463ed7f18d7158efe1ae0081f142e88303c2a54e57f677098923eb93bc
                                    • Opcode Fuzzy Hash: 5468f287aed247b2ce93be947ce76367776866781d1797c0da89900d9844c3d3
                                    • Instruction Fuzzy Hash: 64210821A0C782C2FB659B15B4505AAA3E0FB55B84F954531EA8D4BAFDEF2CE9418B00
                                    Function 00007FFE0138423C Relevance: 7.8, APIs: 5, Instructions: 250fileCOMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: FileRead
                                    • String ID:
                                    • API String ID: 2738559852-0
                                    • Opcode ID: 9566bb113d5d9a9601f31ea826d55321fdd0beeca9f13ccb7a2b5a4f11f99ee8
                                    • Instruction ID: 6e9422c299d5f5bb3b78793530b872eae94257c526c0b709c7eefab9f05dff13
                                    • Opcode Fuzzy Hash: 9566bb113d5d9a9601f31ea826d55321fdd0beeca9f13ccb7a2b5a4f11f99ee8
                                    • Instruction Fuzzy Hash: B2A10722A0C7878AFB609B24A44137E7AA1BF91B98F160131DD4E0FAF6DF7DE4558700
                                    Function 00007FFE013EB62C Relevance: 7.7, APIs: 5, Instructions: 199COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00007FFE01389EC0: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFE013854DE,?,?,?,00007FFE013853F1,?,?,?,?,?,?,?,00007FFE0138532D), ref: 00007FFE01389EC8
                                      • Part of subcall function 00007FFE01389EC0: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00007FFE013854DE,?,?,?,00007FFE013853F1,?,?,?,?,?,?,?,00007FFE0138532D), ref: 00007FFE01389F50
                                      • Part of subcall function 00007FFE01389EC0: GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,00007FFE013854DE,?,?,?,00007FFE013853F1,?,?,?,?,?,?,?,00007FFE0138532D), ref: 00007FFE01389FA2
                                      • Part of subcall function 00007FFE01389EC0: TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,00007FFE013854DE,?,?,?,00007FFE013853F1,?,?,?,?,?,?,?,00007FFE0138532D), ref: 00007FFE013C5FC3
                                    • GetUserDefaultLCID.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FFE013EB7FD
                                    • IsValidCodePage.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FFE013EB83B
                                    • IsValidLocale.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FFE013EB852
                                    • GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FFE013EB8A0
                                    • GetLocaleInfoW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0 ref: 00007FFE013EB8C0
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: Locale$ErrorInfoLastValid$AddressCodeDefaultPageProcUserValue
                                    • String ID:
                                    • API String ID: 2030195362-0
                                    • Opcode ID: f2f1485d9586748bc6347e1db8e5e8d0c9fe7b4c530f4485615fa586f531b1f8
                                    • Instruction ID: 43b0fdc0de58af2b6d4d91e135b907ea7ab220d522e3c1548c07719f956a5d4b
                                    • Opcode Fuzzy Hash: f2f1485d9586748bc6347e1db8e5e8d0c9fe7b4c530f4485615fa586f531b1f8
                                    • Instruction Fuzzy Hash: A7814032A1C7828AEB519F15D4946BAA7E4FF94744F4A4035EA4E4B7E8EF3CE845C700
                                    Function 00007FFE013AD6E0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 264COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: _handle_error
                                    • String ID: !$VUUU$fmod
                                    • API String ID: 1757819995-2579133210
                                    • Opcode ID: 1830e01b7ee7ba0bd65019ced0d26d39a167c0d49156adfeecbd068e878f52e8
                                    • Instruction ID: 987bf43251b3c746f99f9f4b06d77d7eb767bd763fa17f9978fefe6297d5c11d
                                    • Opcode Fuzzy Hash: 1830e01b7ee7ba0bd65019ced0d26d39a167c0d49156adfeecbd068e878f52e8
                                    • Instruction Fuzzy Hash: FAB1D821E1CFC445D7A78A3454513BAB259AFAA390F55D332E95E3ABB4DF3C94828700
                                    Function 00007FFE01383AE0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 78libraryloaderCOMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: AddressInfoLocaleProc
                                    • String ID: GetLocaleInfoEx$LCIDToLocaleName
                                    • API String ID: 2353564440-967963574
                                    • Opcode ID: 68f70359dd9c902e6f9dd55a734c754b13d50ebba99cfc518a1a37e1bdbd5676
                                    • Instruction ID: b14205dcba6339bbe5c7ac582280fabd51dd1057a74902bac773213288dfb964
                                    • Opcode Fuzzy Hash: 68f70359dd9c902e6f9dd55a734c754b13d50ebba99cfc518a1a37e1bdbd5676
                                    • Instruction Fuzzy Hash: D0218DA1B1DB4286EF449B2AE8501796791AF48BE4F454636DD2D4F7F4DE3CE8458300
                                    Function 00007FFE013922F0 Relevance: 6.5, APIs: 2, Strings: 2, Instructions: 495COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: (null)$(null)
                                    • API String ID: 0-1601437019
                                    • Opcode ID: cace3e99ca62958ba7b7b3b7f03d05f8e9308bbe53226c4620ac36686bbdf807
                                    • Instruction ID: 84ca9bf9611c101c6e7136698a12edebc0436ba147586d8d08b766bf1642d538
                                    • Opcode Fuzzy Hash: cace3e99ca62958ba7b7b3b7f03d05f8e9308bbe53226c4620ac36686bbdf807
                                    • Instruction Fuzzy Hash: 9A22B172A08A929AF7648F28C4407BE3BA5FB05B98F225135DE4D5B7A5DF3CD881C740
                                    Function 00007FFE013ECEC0 Relevance: 6.1, APIs: 4, Instructions: 85COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,00007FFE013ED029,?,?,?,?,?,?,00007FFE013C7AEC), ref: 00007FFE013ECECF
                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,00007FFE013ED029,?,?,?,?,?,?,00007FFE013C7AEC), ref: 00007FFE013ECEFB
                                    • Concurrency::details::_Concurrent_queue_iterator_base_v4::~_Concurrent_queue_iterator_base_v4.LIBCPMT ref: 00007FFE013ECF83
                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE013ECFD0
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: ErrorLast$Concurrency::details::_Concurrent_queue_iterator_base_v4Concurrent_queue_iterator_base_v4::~_
                                    • String ID:
                                    • API String ID: 2574209313-0
                                    • Opcode ID: 2ae86d2f741d16eca5e60fc062d9739ebf71204a63a6bd1d30e5fea729fae5ff
                                    • Instruction ID: 11116c1de53819f2582daa0186526668bfd3368ecd7901bdc13d9017ab03266b
                                    • Opcode Fuzzy Hash: 2ae86d2f741d16eca5e60fc062d9739ebf71204a63a6bd1d30e5fea729fae5ff
                                    • Instruction Fuzzy Hash: 9C31C261B0C74342FB589774E56137D62A2AF943A8F055639EA2D0FAFADF3CB8058300
                                    Function 00007FFE013C22DC Relevance: 6.0, APIs: 4, Instructions: 21COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • IsDebuggerPresent.API-MS-WIN-CORE-DEBUG-L1-1-0(?,?,00000000,00007FFE013C24BF,?,?,?,?,00007FFE013C2422,?,?,?,?,00007FFE013C9E62), ref: 00007FFE013C22E5
                                    • SetUnhandledExceptionFilter.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000000,00007FFE013C24BF,?,?,?,?,00007FFE013C2422,?,?,?,?,00007FFE013C9E62), ref: 00007FFE013C22FD
                                    • UnhandledExceptionFilter.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000000,00007FFE013C24BF,?,?,?,?,00007FFE013C2422,?,?,?,?,00007FFE013C9E62), ref: 00007FFE013C2306
                                    • GetCurrentProcess.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,00000000,00007FFE013C24BF,?,?,?,?,00007FFE013C2422,?,?,?,?,00007FFE013C9E62), ref: 00007FFE013C231F
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: ExceptionFilterUnhandled$CurrentDebuggerPresentProcess
                                    • String ID:
                                    • API String ID: 2506494423-0
                                    • Opcode ID: 33a0a22a85f2d33e0fb1ce96dff46e2101dc68a3de606c4b2e631d42720813a3
                                    • Instruction ID: 865386738f084d66d42412673521f4a7190124767eed0673cee1928443cb9be4
                                    • Opcode Fuzzy Hash: 33a0a22a85f2d33e0fb1ce96dff46e2101dc68a3de606c4b2e631d42720813a3
                                    • Instruction Fuzzy Hash: 3EF0E5A0E08B038AFB187B61A82537A6271EF58B45F150439DA1F4E2B2DF7E64898740
                                    Function 00007FFE013E8FB8 Relevance: 4.6, APIs: 3, Instructions: 51COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000098,00007FFE013EBA01,?,?,00000098,00007FFE013C6C48,000000B8), ref: 00007FFE013E8FE9
                                    • EnumSystemLocalesW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,?,?,?,?,?,00000000,00000098,00007FFE013EBA01,?,?,00000098,00007FFE013C6C48,000000B8), ref: 00007FFE013E9023
                                    • LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000098,00007FFE013EBA01,?,?,00000098,00007FFE013C6C48,000000B8), ref: 00007FFE013E9056
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: CriticalSection$EnterEnumLeaveLocalesSystem
                                    • String ID:
                                    • API String ID: 2886288447-0
                                    • Opcode ID: 4152cb601107a6e473515fdbbcf3a2b636bec8c5df5af793327df1b344ac1bf5
                                    • Instruction ID: 69876d91a9bf265761bba57f9976dbe70a468407cc74e3dd3f1e71eb52e25dbe
                                    • Opcode Fuzzy Hash: 4152cb601107a6e473515fdbbcf3a2b636bec8c5df5af793327df1b344ac1bf5
                                    • Instruction Fuzzy Hash: 6E118B72724B4682EB04CB26E8941A97771FB99BC9B468136DE0D8B378DF3CD559C340
                                    Function 00007FFE1327622C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692291900.00007FFE13271000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFE13270000, based on PE: true
                                    • Associated: 00000002.00000002.1692276597.00007FFE13270000.00000002.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13281000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13283000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13286000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692354101.00007FFE13287000.00000080.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692369518.00007FFE13288000.00000004.00000001.01000000.00000007.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13270000_run0796.jbxd
                                    Similarity
                                    • API ID: listen
                                    • String ID: |i:listen
                                    • API String ID: 3257165821-1087349693
                                    • Opcode ID: 7e54749a7b74d6e2c5813bc9d7485d31a403a7c46eab295ab8eac8492f2e1caf
                                    • Instruction ID: 13e33857fa4a8e4bc6c683098ee6a039649135ae139adcd0150906034bf036be
                                    • Opcode Fuzzy Hash: 7e54749a7b74d6e2c5813bc9d7485d31a403a7c46eab295ab8eac8492f2e1caf
                                    • Instruction Fuzzy Hash: F8015E21B18F428AE750AB63E88416A73B0FBF8BA0B504175DA4EA3734DF3DE405C700
                                    Function 00007FFE013EAFC4 Relevance: 3.1, APIs: 2, Instructions: 51COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00007FFE01389EC0: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFE013854DE,?,?,?,00007FFE013853F1,?,?,?,?,?,?,?,00007FFE0138532D), ref: 00007FFE01389EC8
                                      • Part of subcall function 00007FFE01389EC0: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00007FFE013854DE,?,?,?,00007FFE013853F1,?,?,?,?,?,?,?,00007FFE0138532D), ref: 00007FFE01389F50
                                    • GetPrimaryLen.LIBCMT ref: 00007FFE013EB02D
                                    • EnumSystemLocalesW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,?,?,?,?,000000B8,00000000,000000BC,000001C2,?,?,00007FFE013C8D7C), ref: 00007FFE013EB042
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: ErrorLast$EnumLocalesPrimarySystem
                                    • String ID:
                                    • API String ID: 1794546269-0
                                    • Opcode ID: 177b6059fd2e80799859cf17f3ea94077da4b79de250921c449ceb3879b9ac6f
                                    • Instruction ID: 3e331516d7e271ff19f853e06306cb93d4bbb2ca65f227847b96e3173d5e361d
                                    • Opcode Fuzzy Hash: 177b6059fd2e80799859cf17f3ea94077da4b79de250921c449ceb3879b9ac6f
                                    • Instruction Fuzzy Hash: 4011A0A3A0874186EB518F25E4402BD7BA1EB90BA1F158235D6694B3EDDF3DE981C740
                                    Function 00007FFE013EB074 Relevance: 3.0, APIs: 2, Instructions: 32COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00007FFE01389EC0: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFE013854DE,?,?,?,00007FFE013853F1,?,?,?,?,?,?,?,00007FFE0138532D), ref: 00007FFE01389EC8
                                      • Part of subcall function 00007FFE01389EC0: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00007FFE013854DE,?,?,?,00007FFE013853F1,?,?,?,?,?,?,?,00007FFE0138532D), ref: 00007FFE01389F50
                                    • GetPrimaryLen.LIBCMT ref: 00007FFE013EB0BA
                                    • EnumSystemLocalesW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,000001C2,00007FFE013EB740,?,?,?,000000B8,00000000,000000BC,000001C2,?,?,00007FFE013C8D7C), ref: 00007FFE013EB0D2
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: ErrorLast$EnumLocalesPrimarySystem
                                    • String ID:
                                    • API String ID: 1794546269-0
                                    • Opcode ID: 780ca263feb8d13bf17dc03d657bbbd60b35403ac77c22bac1965f057e6a0b30
                                    • Instruction ID: 1c2e0b7ddf78471aed8c6538d7d9292953b7b33e0596395eca7217cc130337d3
                                    • Opcode Fuzzy Hash: 780ca263feb8d13bf17dc03d657bbbd60b35403ac77c22bac1965f057e6a0b30
                                    • Instruction Fuzzy Hash: B5F04462A0C74682EB525F25D840379BAD1EB907A8F158231E6794B2FDDF3DE8818701
                                    Function 00007FFE013EAF64 Relevance: 1.5, APIs: 1, Instructions: 26COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00007FFE01389EC0: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFE013854DE,?,?,?,00007FFE013853F1,?,?,?,?,?,?,?,00007FFE0138532D), ref: 00007FFE01389EC8
                                      • Part of subcall function 00007FFE01389EC0: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00007FFE013854DE,?,?,?,00007FFE013853F1,?,?,?,?,?,?,?,00007FFE0138532D), ref: 00007FFE01389F50
                                    • EnumSystemLocalesW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,000001C2,00007FFE013EB7F3,?,?,?,000000B8,00000000,000000BC,000001C2,?,?,00007FFE013C8D7C), ref: 00007FFE013EAFAB
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: ErrorLast$EnumLocalesSystem
                                    • String ID:
                                    • API String ID: 2417226690-0
                                    • Opcode ID: c64bcbe02d99453967383afca337fd9476b3630fed294925e5c9ab5ab45e3c02
                                    • Instruction ID: db432e7ab3052fe716135103d11dbcddb4a7d53bc28280b699cc762e77dd73df
                                    • Opcode Fuzzy Hash: c64bcbe02d99453967383afca337fd9476b3630fed294925e5c9ab5ab45e3c02
                                    • Instruction Fuzzy Hash: A9F05EA2A0878541EB115B65E9403ADBBE2EB90BB4F568231DA784B3F9CA7CC4918701
                                    Function 00007FFE132763D8 Relevance: 1.5, APIs: 1, Instructions: 21networkCOMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692291900.00007FFE13271000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFE13270000, based on PE: true
                                    • Associated: 00000002.00000002.1692276597.00007FFE13270000.00000002.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13281000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13283000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13286000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692354101.00007FFE13287000.00000080.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692369518.00007FFE13288000.00000004.00000001.01000000.00000007.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13270000_run0796.jbxd
                                    Similarity
                                    • API ID: recv
                                    • String ID:
                                    • API String ID: 1507349165-0
                                    • Opcode ID: dd653d862c5c62c1c71e7322989cf73bc52b7027a9c5e9c9d1b242698b261d5d
                                    • Instruction ID: 4fca4fec68a2a21c82ad95da37f53a13f0faa42c8bb59a434210c3ba0e2dec4d
                                    • Opcode Fuzzy Hash: dd653d862c5c62c1c71e7322989cf73bc52b7027a9c5e9c9d1b242698b261d5d
                                    • Instruction Fuzzy Hash: 65E012B1B00A4586DB68AB1AD45123573A0F759F74F245735DE3D9B7D0CE28D8E1C740
                                    Function 00007FF60F1850B0 Relevance: 164.8, APIs: 31, Strings: 63, Instructions: 263libraryloaderCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1691492610.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000002.00000002.1691469586.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691519836.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691591884.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: AddressProc
                                    • String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                    • API String ID: 190572456-2208601799
                                    • Opcode ID: 77b5a64d38601d97cc6f46ef17bc262d941289dca8cc320d3ff37db910af6723
                                    • Instruction ID: 56edb9b569ef60ff2d2885b7c327a08e2a12ad883c1598bf95737ca3d3269369
                                    • Opcode Fuzzy Hash: 77b5a64d38601d97cc6f46ef17bc262d941289dca8cc320d3ff37db910af6723
                                    • Instruction Fuzzy Hash: 1FE17574A0DB0790FA59DB14AA6017833E6EF047A0BB865B5C80E86364EFBDF55DD380
                                    Function 00007FFE013BDEF8 Relevance: 75.7, APIs: 40, Strings: 3, Instructions: 480COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: Name::operator+Name::operator+=$Name$Name::Name::operator=$Name::doPchar$Decorator::get$ArgumentDataListSymbolTemplateType
                                    • String ID: `anonymous namespace'$`string'$operator
                                    • API String ID: 3364110030-815891235
                                    • Opcode ID: c61802edf81636580396196de44457ab2d519fa2b74cbead1b50503d1cc9aaf1
                                    • Instruction ID: 9c3801dd2c5c07b62ec2736dd4167b0c20123c1be2b890f8a44671b0ca8c8b3e
                                    • Opcode Fuzzy Hash: c61802edf81636580396196de44457ab2d519fa2b74cbead1b50503d1cc9aaf1
                                    • Instruction Fuzzy Hash: F5226A72E19A5698FB14DB68C8D02FC37B1AF44788F564036DB0E5FAB9EE2CE4558340
                                    Function 00007FFE013BC000 Relevance: 73.8, APIs: 17, Strings: 25, Instructions: 277COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: Name::operator+Name::operator+=Name::operator=$Decorator::getNameName::Type$DataName::doPchar
                                    • String ID: volatile$<unknown>$UNKNOWN$__int128$__int16$__int32$__int64$__int8$__w64 $bool$char$char16_t$char32_t$const$double$float$int$long$long $short$signed $unsigned $void$volatile$wchar_t
                                    • API String ID: 1522823107-3737837666
                                    • Opcode ID: ff4dd32bca4f277370fa855c8bd494b103e14d7739e4ec44ac55491472eeadb5
                                    • Instruction ID: 9aa4ff5f5318f2ea79c2f53670a01812f1a8356d7078740acf515abcfbdc7ebf
                                    • Opcode Fuzzy Hash: ff4dd32bca4f277370fa855c8bd494b103e14d7739e4ec44ac55491472eeadb5
                                    • Instruction Fuzzy Hash: BCD13B62E18A5399FB60CB64D8C02BC3361BF45788F966432DB1D9E6B5EF6CE645C300
                                    Function 00007FFE13308F68 Relevance: 58.0, APIs: 8, Strings: 25, Instructions: 288COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: Name::operator+$Name::operator+=Name::operator=
                                    • String ID: volatile$<unknown>$UNKNOWN$__int128$__int16$__int32$__int64$__int8$__w64 $bool$char$char16_t$char32_t$const$double$float$int$long$long $short$signed $unsigned $void$volatile$wchar_t
                                    • API String ID: 2985695045-3737837666
                                    • Opcode ID: bf7e98c3344c0179c6ddaaa74246d4408eef3205f29f3d89c83678baefc845d4
                                    • Instruction ID: 7f1d728550214c48315e75315b30c893771613bd24b8837009f2003ec5ed2fe6
                                    • Opcode Fuzzy Hash: bf7e98c3344c0179c6ddaaa74246d4408eef3205f29f3d89c83678baefc845d4
                                    • Instruction Fuzzy Hash: 8FD14B62E18E429CFB14CB66E8801BC2774BB24364F5045B2DA3DB66B5DF7CE588C308
                                    Function 00007FFE133058A0 Relevance: 53.0, APIs: 27, Strings: 3, Instructions: 493COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: Name::operator+$Name::operator+=$Name::operator=$Decorator::getNameSymbol
                                    • String ID: `anonymous namespace'$`string'$operator
                                    • API String ID: 1939614110-815891235
                                    • Opcode ID: 0a418c01cc5cb1d78d8ecc88b58af45e4c8bff701549ed15115c360b0e5e7569
                                    • Instruction ID: 631ba1e576b5a3ed5e173499abca3392a38d021910c76f2075977ad178bdbb08
                                    • Opcode Fuzzy Hash: 0a418c01cc5cb1d78d8ecc88b58af45e4c8bff701549ed15115c360b0e5e7569
                                    • Instruction Fuzzy Hash: 76326C62B1CE56CDFB04DB66D8801FC2771BB247A8F5441B2DA6D27AA9DF2CE445C308
                                    Function 00007FFE13302000 Relevance: 51.2, APIs: 26, Strings: 3, Instructions: 403COMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00007FFE1330BDE4: RtlLookupFunctionEntry.KERNEL32(?,?,?,?,?,?,?,00007FFE1330204C), ref: 00007FFE1330BEB9
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE13302118
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE13302134
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE13302149
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE13302166
                                    • terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE1330219C
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE133021AD
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE133021C5
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE133021DA
                                    • terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE13302205
                                    • terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE1330220C
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE1330239A
                                    • CatchIt.LIBVCRUNTIME ref: 00007FFE133023D9
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE133023F0
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE133023F7
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE133023FE
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE13302405
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE13302469
                                    • terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE1330247D
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE13302494
                                    • _UnwindNestedFrames.LIBVCRUNTIME ref: 00007FFE133024EE
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE133024FD
                                    • terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE1330252C
                                    • terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE1330253A
                                    • terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE13302541
                                      • Part of subcall function 00007FFE133028B0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000066,?,00007FFE1330252A), ref: 00007FFE133028E6
                                      • Part of subcall function 00007FFE133028B0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000066,?,00007FFE1330252A), ref: 00007FFE13302919
                                      • Part of subcall function 00007FFE133028B0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000066,?,00007FFE1330252A), ref: 00007FFE13302958
                                      • Part of subcall function 00007FFE133028B0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000066,?,00007FFE1330252A), ref: 00007FFE13302979
                                      • Part of subcall function 00007FFE133028B0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000066,?,00007FFE1330252A), ref: 00007FFE1330299C
                                      • Part of subcall function 00007FFE133028B0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000066,?,00007FFE1330252A), ref: 00007FFE133029BA
                                    • std::bad_alloc::bad_alloc.LIBCMT ref: 00007FFE13302571
                                    • _CxxThrowException.LIBVCRUNTIME ref: 00007FFE13302581
                                      • Part of subcall function 00007FFE13304620: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFE13302586), ref: 00007FFE1330469D
                                      • Part of subcall function 00007FFE13304620: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FFE13302586), ref: 00007FFE133046DC
                                      • Part of subcall function 00007FFE13304380: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFE13301CA0), ref: 00007FFE133043BA
                                      • Part of subcall function 00007FFE13304380: strcpy_s.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFE13301CA0), ref: 00007FFE133043D2
                                      • Part of subcall function 00007FFE13304380: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFE13301CA0), ref: 00007FFE133043E8
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: abort$terminate$Exception$CatchEntryFileFramesFunctionHeaderLookupNestedRaiseThrowUnwindfreemallocstd::bad_alloc::bad_allocstrcpy_s
                                    • String ID: csm$csm$csm
                                    • API String ID: 3386888594-393685449
                                    • Opcode ID: 3626c349750869fe565dd3b9c9181262c1049519526de4ccc4dcac70c7db7e4f
                                    • Instruction ID: 563e49e3c729f385512ae817d8d8e55d72d4aa1cfb50600cbd1451d8b0293ff1
                                    • Opcode Fuzzy Hash: 3626c349750869fe565dd3b9c9181262c1049519526de4ccc4dcac70c7db7e4f
                                    • Instruction Fuzzy Hash: DB029C32A08F428EEA589F66D0842BD67A4FF64B68F0404B5DE6D637A5CF3CE455C318
                                    Function 00007FFE013BF7C4 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 235COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: Name::operator+=$Name::operator+$NameName::$DataDecorator::getName::doPcharTypeswprintf
                                    • String ID: NULL$`generic-class-parameter-$`generic-method-parameter-$`template-type-parameter-
                                    • API String ID: 1509416489-4167119577
                                    • Opcode ID: 342a287a45dd78f49881eb4e3cb1e06f0c8bfac052982164067d2caad856c3fb
                                    • Instruction ID: 718d40f038c71ee7cc9937387aaa6fdb400755e4bb15cdfe08a3c9c3f0b66b08
                                    • Opcode Fuzzy Hash: 342a287a45dd78f49881eb4e3cb1e06f0c8bfac052982164067d2caad856c3fb
                                    • Instruction Fuzzy Hash: 6BB17B22E0CA4298FB14DB64C8D43FC7365AF55748F961036CB0D5BAB6EE6CE60AC740
                                    Function 00007FFE013BD768 Relevance: 39.3, APIs: 26, Instructions: 342COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: Name::operator+Name::operator+=
                                    • String ID:
                                    • API String ID: 382699925-0
                                    • Opcode ID: bf514128ed70bf8e329dd96175d2162b2aae0341c907da1aa4dc3e1525c7a98b
                                    • Instruction ID: 5f40c56c3d03233b7c0c6e821d8e0d8cd61774127a05e50149c87a0c3c9d4400
                                    • Opcode Fuzzy Hash: bf514128ed70bf8e329dd96175d2162b2aae0341c907da1aa4dc3e1525c7a98b
                                    • Instruction Fuzzy Hash: B3F16876B08A86AEFB11DFA4D4801EC37B1EB4474CB454036DB4D6BAA9EE7CD619C340
                                    Function 00007FFE13303460 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 242COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: abort$ErrorLast$FileHeaderValue_calloc_base_free_base
                                    • String ID: ?AVbad_exception@std@@$MOC$RCC$csm$csm
                                    • API String ID: 2425072861-1914178954
                                    • Opcode ID: 5ddc374ad099d947232a7d8a7f0c32787dabcb296a25caccbb93ce29c81494a5
                                    • Instruction ID: 7b7fa9e6fde098a6e15647c491125f6767bb8157c2e68af090b8a9bef2f3a8f1
                                    • Opcode Fuzzy Hash: 5ddc374ad099d947232a7d8a7f0c32787dabcb296a25caccbb93ce29c81494a5
                                    • Instruction Fuzzy Hash: 4DA1CF72E09F428AEA659B52D04427E67A0FF68F74F0408B5DA6D23775DF3CE441CA09
                                    Function 00007FFE13272370 Relevance: 30.0, APIs: 9, Strings: 8, Instructions: 281networkCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692291900.00007FFE13271000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFE13270000, based on PE: true
                                    • Associated: 00000002.00000002.1692276597.00007FFE13270000.00000002.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13281000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13283000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13286000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692354101.00007FFE13287000.00000080.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692369518.00007FFE13288000.00000004.00000001.01000000.00000007.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13270000_run0796.jbxd
                                    Similarity
                                    • API ID: Socketgetsocknamegetsockopt
                                    • String ID: Oiii$iii$integer argument expected, got float$negative file descriptor$socket descriptor string has wrong size, should be %zu bytes.$socket()$socket.__new__$|iiiO:socket
                                    • API String ID: 1917005709-2392107858
                                    • Opcode ID: ed40e7bf5bd58044e5a72c47c0ce755f19d53f56eeecac347b5218d737ade378
                                    • Instruction ID: 050dc86ddc57994044abf66a96877610c50006ea624588162c9bef208d3de4a6
                                    • Opcode Fuzzy Hash: ed40e7bf5bd58044e5a72c47c0ce755f19d53f56eeecac347b5218d737ade378
                                    • Instruction Fuzzy Hash: 55E13E32A08B428AE720AF2AE4541797760FBF5BB4F205375DA5D626B4DF3CE585C700
                                    Function 00007FFE13303930 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 136COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: abort$terminate
                                    • String ID: csm$csm
                                    • API String ID: 579254285-3733052814
                                    • Opcode ID: fe75575324e898bddb0e030716503548cf80929cbfae6fbe91e7efb773c12368
                                    • Instruction ID: 1689fd2a920e5cdc6bcb74f50ce4b9dc5890f3db783854e4a3a2b15fbbc4968f
                                    • Opcode Fuzzy Hash: fe75575324e898bddb0e030716503548cf80929cbfae6fbe91e7efb773c12368
                                    • Instruction Fuzzy Hash: 47514F32E0DF4689EE686B57C04413D26B4AFB8B35F0409B9D97D327B2DF2DE8108119
                                    Function 00007FFE1330616C Relevance: 28.3, APIs: 15, Strings: 1, Instructions: 299COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: Name::operator+$Name::operator+=Replicator::operator[]
                                    • String ID: `anonymous namespace'
                                    • API String ID: 2709820770-3062148218
                                    • Opcode ID: 82e5f84ef63da0c09f1d45ac61254de523a11a8ca8f628e7ef5fa0c4bf2e3efc
                                    • Instruction ID: 90ecc6addd2a9f027503cf08bcbe08fd61f5aca563157a29da0584527520191d
                                    • Opcode Fuzzy Hash: 82e5f84ef63da0c09f1d45ac61254de523a11a8ca8f628e7ef5fa0c4bf2e3efc
                                    • Instruction Fuzzy Hash: E4E19E72A08F829DEB14CF66D8802ED37A0FB647A4F5040B5EA5D27BAADF38D554C704
                                    Function 00007FFE133025C8 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 196COMMON
                                    Download Yara Rule
                                    APIs
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000066,?,00007FFE1330252A), ref: 00007FFE13302608
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000066,?,00007FFE1330252A), ref: 00007FFE1330262B
                                    • EncodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,00000066,?,00007FFE1330252A), ref: 00007FFE13302634
                                    • CatchIt.LIBVCRUNTIME ref: 00007FFE13302837
                                      • Part of subcall function 00007FFE13302C84: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE13302CF1
                                      • Part of subcall function 00007FFE13302C84: _UnwindNestedFrames.LIBVCRUNTIME ref: 00007FFE13302D34
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000066,?,00007FFE1330252A), ref: 00007FFE13302867
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000066,?,00007FFE1330252A), ref: 00007FFE1330286E
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000066,?,00007FFE1330252A), ref: 00007FFE13302875
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000066,?,00007FFE1330252A), ref: 00007FFE1330287C
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000066,?,00007FFE1330252A), ref: 00007FFE13302883
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000066,?,00007FFE1330252A), ref: 00007FFE1330288A
                                      • Part of subcall function 00007FFE133048F4: GetLastError.KERNEL32(?,?,?,00007FFE13301831), ref: 00007FFE13304918
                                      • Part of subcall function 00007FFE133048F4: SetLastError.KERNEL32(?,?,?,00007FFE13301831), ref: 00007FFE133049C0
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000066,?,00007FFE1330252A), ref: 00007FFE13302891
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000066,?,00007FFE1330252A), ref: 00007FFE13302898
                                    • terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000066,?,00007FFE1330252A), ref: 00007FFE1330289F
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: abort$ErrorLast$CatchEncodeFramesNestedPointerUnwindterminate
                                    • String ID: MOC$RCC
                                    • API String ID: 2140352205-2084237596
                                    • Opcode ID: d1b7c608141e651fae73115cad78fec1ac335fdd7b28dfb3f62e3715bf8cc4f2
                                    • Instruction ID: 31d7c75f02deef8dc9dc4506c961ba8b55c9ef8c0f721e69a05d35ce33d2823f
                                    • Opcode Fuzzy Hash: d1b7c608141e651fae73115cad78fec1ac335fdd7b28dfb3f62e3715bf8cc4f2
                                    • Instruction Fuzzy Hash: 50819D32A08E8689EB249B16D48477D6760FFA4F6AF044875CA6D637B5CF3CE105C718
                                    Function 00007FFE13309574 Relevance: 25.9, APIs: 17, Instructions: 393COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: Name::operator+Name::operator+=
                                    • String ID:
                                    • API String ID: 382699925-0
                                    • Opcode ID: d14701550f813a1b5f0a6813c5cfc38f9d7d7c563afc0a5d8f31b01ef8bfca20
                                    • Instruction ID: 4aa6a9d36efa7ee210d2e60c6c88e63889558caf45cec0b28b70162ead82b4bc
                                    • Opcode Fuzzy Hash: d14701550f813a1b5f0a6813c5cfc38f9d7d7c563afc0a5d8f31b01ef8bfca20
                                    • Instruction Fuzzy Hash: D3129C76B08E469EEB10CF66D4801FD37B0EB24758B4040B6EA6D67BBADE38D515C348
                                    Function 00007FFE13306DC4 Relevance: 24.8, APIs: 9, Strings: 5, Instructions: 257COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: Name::operator+Name::operator+=$atol
                                    • String ID: NULL$`generic-class-parameter-$`generic-method-parameter-$`template-type-parameter-${
                                    • API String ID: 2344370515-4023094362
                                    • Opcode ID: 3ccc18cc20a8de763716fe189613d3dfe9f7631dc5b97b57d434d142ef750345
                                    • Instruction ID: 84575b76ec730756ecc387934c3650dad85dc990263b890c5f4c20f5fb5cf7f2
                                    • Opcode Fuzzy Hash: 3ccc18cc20a8de763716fe189613d3dfe9f7631dc5b97b57d434d142ef750345
                                    • Instruction Fuzzy Hash: 26B1C562A0CE429CFB15DB22D4501FD27A1EF64764F5401B5EA6E36ABACF3CE149C348
                                    Function 00007FFE13272290 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 180COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692291900.00007FFE13271000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFE13270000, based on PE: true
                                    • Associated: 00000002.00000002.1692276597.00007FFE13270000.00000002.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13281000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13283000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13286000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692354101.00007FFE13287000.00000080.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692369518.00007FFE13288000.00000004.00000001.01000000.00000007.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13270000_run0796.jbxd
                                    Similarity
                                    • API ID: AddrFreeInfo$getaddrinfoinet_pton
                                    • String ID: 255.255.255.255$<broadcast>$address family mismatched$unknown address family$unsupported address family$wildcard resolved to multiple address
                                    • API String ID: 3456548859-1715193308
                                    • Opcode ID: dca16e9962d2758a608fc27b3aee0d7f866cd99c237aefc7057d199c280d6f73
                                    • Instruction ID: 6df20c76c1f1a2f4ab47186a46511f491264c44ff73c0f9ec1194c0f8494b585
                                    • Opcode Fuzzy Hash: dca16e9962d2758a608fc27b3aee0d7f866cd99c237aefc7057d199c280d6f73
                                    • Instruction Fuzzy Hash: 2F814C21A08F428AE760AF26A80427963A1BBF5BA4F5442B2DA5D777B4DF3CE545C700
                                    Function 00007FFE13272B14 Relevance: 24.2, APIs: 16, Instructions: 235COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692291900.00007FFE13271000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFE13270000, based on PE: true
                                    • Associated: 00000002.00000002.1692276597.00007FFE13270000.00000002.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13281000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13283000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13286000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692354101.00007FFE13287000.00000080.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692369518.00007FFE13288000.00000004.00000001.01000000.00000007.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13270000_run0796.jbxd
                                    Similarity
                                    • API ID: Initialize__scrt_acquire_startup_lock__scrt_fastfail__scrt_release_startup_lock$__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_initialize_default_local_stdio_options__scrt_is_nonwritable_in_current_image__scrt_uninitialize_crt
                                    • String ID:
                                    • API String ID: 627783611-0
                                    • Opcode ID: abc692eb7a093c0b15c8035d40e5ce3b2c0fb7fba3fadb6c77fd15417b76ea17
                                    • Instruction ID: 823c9ae0b3cb6f8502b208a8e752bb33f51917cdb875a40141e4407b8b1db916
                                    • Opcode Fuzzy Hash: abc692eb7a093c0b15c8035d40e5ce3b2c0fb7fba3fadb6c77fd15417b76ea17
                                    • Instruction Fuzzy Hash: 08918F21E08F434EF664BB6794822B922A0BFFA7A0F1440B5DA4D677B6DE3CE441C740
                                    Function 00007FFE148E1114 Relevance: 24.2, APIs: 16, Instructions: 235COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692491940.00007FFE148E1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FFE148E0000, based on PE: true
                                    • Associated: 00000002.00000002.1692469000.00007FFE148E0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                    • Associated: 00000002.00000002.1692491940.00007FFE148E9000.00000040.00000001.01000000.00000008.sdmpDownload File
                                    • Associated: 00000002.00000002.1692543814.00007FFE148EA000.00000080.00000001.01000000.00000008.sdmpDownload File
                                    • Associated: 00000002.00000002.1692562185.00007FFE148EC000.00000004.00000001.01000000.00000008.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe148e0000_run0796.jbxd
                                    Similarity
                                    • API ID: Initialize__scrt_acquire_startup_lock__scrt_fastfail__scrt_release_startup_lock$__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_initialize_default_local_stdio_options__scrt_is_nonwritable_in_current_image__scrt_uninitialize_crt
                                    • String ID:
                                    • API String ID: 627783611-0
                                    • Opcode ID: aed60c4f90e4819b847f02365d3c23cbe61a8e4db50aaa61ce56ee17cee8997e
                                    • Instruction ID: 59c4ff93eaa16815ad8ecdd215e8970fe287b173a18df2fe6dd10139b42245ac
                                    • Opcode Fuzzy Hash: aed60c4f90e4819b847f02365d3c23cbe61a8e4db50aaa61ce56ee17cee8997e
                                    • Instruction Fuzzy Hash: A5918221E0CE4385FA50AB6794C12F9E291AF877A0F4441B5FA4D677B7DE3CE8498700
                                    Function 00007FFE13277944 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 149COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692291900.00007FFE13271000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFE13270000, based on PE: true
                                    • Associated: 00000002.00000002.1692276597.00007FFE13270000.00000002.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13281000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13283000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13286000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692354101.00007FFE13287000.00000080.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692369518.00007FFE13288000.00000004.00000001.01000000.00000007.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13270000_run0796.jbxd
                                    Similarity
                                    • API ID: AddrFreeInfogetaddrinfogetnameinfohtonl
                                    • String ID: $(O)$IPv4 sockaddr must be 2 tuple$Oi:getnameinfo$getnameinfo() argument 1 must be a tuple$getnameinfo(): flowinfo must be 0-1048575.$si|II;getnameinfo(): illegal sockaddr argument$sockaddr resolved to multiple addresses$socket.getnameinfo
                                    • API String ID: 4001298222-3083988921
                                    • Opcode ID: 8172ef050336c576baa91661fce6dafb572fbb64b907fef6e4d363b14985fb42
                                    • Instruction ID: 0d62928efe821e379e9fd1edffcd383ab43849d7854d35c2e8cb777f93048ed8
                                    • Opcode Fuzzy Hash: 8172ef050336c576baa91661fce6dafb572fbb64b907fef6e4d363b14985fb42
                                    • Instruction Fuzzy Hash: BE810D71A08F428AEB10AB26E4442BA73B1FBE4BA4F500176DA4D67A74DF7CE545CB40
                                    Function 00007FFE013C02D8 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 197COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: Decorator::getNameTemplate
                                    • String ID: generic-type-$template-parameter-
                                    • API String ID: 1828801485-13229604
                                    • Opcode ID: cd794bd184d42fcc430be5404e90855acf66cd71f42aa28de855b1b3bb644124
                                    • Instruction ID: 9ce5912ba29b390cc330ea22cb1a3e55d90730c770262da670d17428f51bd1aa
                                    • Opcode Fuzzy Hash: cd794bd184d42fcc430be5404e90855acf66cd71f42aa28de855b1b3bb644124
                                    • Instruction Fuzzy Hash: 5D917826A08A86DAEB14CB64D8903BD33B1AB54788F864032EA4D5F7B5DF7DE509C740
                                    Function 00007FFE13302A48 Relevance: 21.2, APIs: 14, Instructions: 156COMMON
                                    Download Yara Rule
                                    APIs
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000000,?,00007FFE13301EE3), ref: 00007FFE13302A7C
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000000,?,00007FFE13301EE3), ref: 00007FFE13302AB5
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000000,?,00007FFE13301EE3), ref: 00007FFE13302AED
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000000,?,00007FFE13301EE3), ref: 00007FFE13302B16
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000000,?,00007FFE13301EE3), ref: 00007FFE13302B38
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000000,?,00007FFE13301EE3), ref: 00007FFE13302B4C
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000000,?,00007FFE13301EE3), ref: 00007FFE13302B86
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000000,?,00007FFE13301EE3), ref: 00007FFE13302BA8
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000000,?,00007FFE13301EE3), ref: 00007FFE13302BBC
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000000,?,00007FFE13301EE3), ref: 00007FFE13302BF1
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: abort
                                    • String ID:
                                    • API String ID: 4206212132-0
                                    • Opcode ID: fead68839a78518182c3d658b19b0aea22ffa5b8ddac6850a95f5d947da0cf14
                                    • Instruction ID: 842614537ae0f6b50fbaef34af58c93b14071919c01255ae8d4213392564e694
                                    • Opcode Fuzzy Hash: fead68839a78518182c3d658b19b0aea22ffa5b8ddac6850a95f5d947da0cf14
                                    • Instruction Fuzzy Hash: B251A232A08F428AEA14AB52D58423C6360FF78B65F0049B6CE3D637B1CF3DE4568319
                                    Function 00007FFE013E4D18 Relevance: 21.2, APIs: 4, Strings: 8, Instructions: 151COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: ErrorLast
                                    • String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
                                    • API String ID: 1452528299-2617248754
                                    • Opcode ID: b7f5d93782a90aa7d0ad063588971812f68eaa9763b833481060027aa673e715
                                    • Instruction ID: 7588ca8797861549272bb0d47e9dab11687d19989845852ffb350ff23f1997bc
                                    • Opcode Fuzzy Hash: b7f5d93782a90aa7d0ad063588971812f68eaa9763b833481060027aa673e715
                                    • Instruction Fuzzy Hash: 07615B31A0DB428AEB549B74E8513B933E5AF98398F010635DA5D4BBF9EF3CA5158340
                                    Function 00007FFE013BE690 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 148COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: Name::operator+$Name::operator+=Name::operator=$Decorator::getNameName::Name::doPcharType
                                    • String ID: std::nullptr_t$std::nullptr_t $volatile
                                    • API String ID: 651045434-294867888
                                    • Opcode ID: c78329094525fcf9904cbeeeaf0260f8faebf6f791a68138268abbf138ed1c33
                                    • Instruction ID: b4bb036685d7bdd98109be83b89012239b0bc5bfc270c848622c3927773c32dd
                                    • Opcode Fuzzy Hash: c78329094525fcf9904cbeeeaf0260f8faebf6f791a68138268abbf138ed1c33
                                    • Instruction Fuzzy Hash: D9615E72E08A5294FB149F68D8900F877B5FB04B88B594136DB4E4BAB5EF7CE150C300
                                    Function 00007FFE0138B260 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 291COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00007FFE01389EC0: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFE013854DE,?,?,?,00007FFE013853F1,?,?,?,?,?,?,?,00007FFE0138532D), ref: 00007FFE01389EC8
                                      • Part of subcall function 00007FFE01389EC0: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00007FFE013854DE,?,?,?,00007FFE013853F1,?,?,?,?,?,?,?,00007FFE0138532D), ref: 00007FFE01389F50
                                    • EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FFE013D1EF1), ref: 00007FFE0138B28B
                                      • Part of subcall function 00007FFE01398DD0: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFE013CA666,?,?,00000000,00007FFE013CD82A,?,?,?,00007FFE013C7AE1), ref: 00007FFE01398DE4
                                      • Part of subcall function 00007FFE01398DD0: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFE013CA666,?,?,00000000,00007FFE013CD82A,?,?,?,00007FFE013C7AE1), ref: 00007FFE01398E2B
                                    • LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FFE013D1EF1), ref: 00007FFE0138B2FE
                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE0138B376
                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE0138B437
                                    • Concurrency::details::_Concurrent_queue_iterator_base_v4::~_Concurrent_queue_iterator_base_v4.LIBCPMT ref: 00007FFE013C99DA
                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE013C99E1
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: ErrorLast$CriticalSection$Concurrency::details::_Concurrent_queue_iterator_base_v4Concurrent_queue_iterator_base_v4::~_EnterLeave
                                    • String ID: FlsGetValue
                                    • API String ID: 3230684533-662576866
                                    • Opcode ID: c3426e38f44684b669efdbbce9432b6eace8fcc3b84cc672725d4ea16a0b2ae9
                                    • Instruction ID: 4541b4374ef776389a543d545fa1c797c770d77c8a052abcedbaec896ef4a164
                                    • Opcode Fuzzy Hash: c3426e38f44684b669efdbbce9432b6eace8fcc3b84cc672725d4ea16a0b2ae9
                                    • Instruction Fuzzy Hash: A6C19A32B19B438AFB148B25E8512BD63A5AF48798F4A4536D91D4F7B9EF3CE805C301
                                    Function 00007FFE1327725C Relevance: 19.5, APIs: 3, Strings: 8, Instructions: 244COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692291900.00007FFE13271000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFE13270000, based on PE: true
                                    • Associated: 00000002.00000002.1692276597.00007FFE13270000.00000002.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13281000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13283000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13286000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692354101.00007FFE13287000.00000080.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692369518.00007FFE13288000.00000004.00000001.01000000.00000007.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13270000_run0796.jbxd
                                    Similarity
                                    • API ID: AddrFreeInfo$getaddrinfo
                                    • String ID: %ld$Int or String expected$OOiii$OO|iiii:getaddrinfo$getaddrinfo() argument 1 must be string or None$idna$iiisO$socket.getaddrinfo
                                    • API String ID: 2288433384-3943835681
                                    • Opcode ID: 8720e96b0350aa0fa432fd23d9cb1f5c97aff05348f0c23218e180449fa3eb16
                                    • Instruction ID: b30d499f704e0918f39943ea69512ca48e064c37f1dc134d795d0eaf8323fdfd
                                    • Opcode Fuzzy Hash: 8720e96b0350aa0fa432fd23d9cb1f5c97aff05348f0c23218e180449fa3eb16
                                    • Instruction Fuzzy Hash: E7B10A72B08F128AEB10EF66E4505BC23B1BBB9BA4B0445B5DE0E67764DE3CE445C740
                                    Function 00007FFE13303C70 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 172COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: ExceptionThrow$FileHeaderstd::bad_alloc::bad_alloc
                                    • String ID: Access violation - no RTTI data!$Bad read pointer - no RTTI data!
                                    • API String ID: 63457273-1829174677
                                    • Opcode ID: 48d942c1111f90c57d4d77f2c68cd7c094e12fa67c9e4fed7b0efa5bcd1c6e13
                                    • Instruction ID: 62e943450dc8cbb3b4048113965d3e1047151e8f8e58fdf10ec504bf8cc4ea44
                                    • Opcode Fuzzy Hash: 48d942c1111f90c57d4d77f2c68cd7c094e12fa67c9e4fed7b0efa5bcd1c6e13
                                    • Instruction Fuzzy Hash: 0F61A032718E869AEA10CF12E5802BEA3A0FB64BB4F405175EAAD53775DF3CD545C704
                                    Function 00007FFE13303040 Relevance: 18.2, APIs: 12, Instructions: 168COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,00007FFE133032A3,?,?,?,00007FFE13302CE7), ref: 00007FFE1330307A
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,00007FFE133032A3,?,?,?,00007FFE13302CE7), ref: 00007FFE133030AD
                                    • terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,00007FFE133032A3,?,?,?,00007FFE13302CE7), ref: 00007FFE1330311A
                                    • terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,00007FFE133032A3,?,?,?,00007FFE13302CE7), ref: 00007FFE13303138
                                    • __AdjustPointer.LIBCMT ref: 00007FFE13303179
                                    • terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,00007FFE133032A3,?,?,?,00007FFE13302CE7), ref: 00007FFE13303186
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,00007FFE133032A3,?,?,?,00007FFE13302CE7), ref: 00007FFE1330319F
                                    • __AdjustPointer.LIBCMT ref: 00007FFE133031D3
                                    • terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,00007FFE133032A3,?,?,?,00007FFE13302CE7), ref: 00007FFE133031E8
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,00007FFE133032A3,?,?,?,00007FFE13302CE7), ref: 00007FFE1330320A
                                    • terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,00007FFE133032A3,?,?,?,00007FFE13302CE7), ref: 00007FFE13303239
                                    • terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,00007FFE133032A3,?,?,?,00007FFE13302CE7), ref: 00007FFE13303240
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: terminate$abort$AdjustPointer
                                    • String ID:
                                    • API String ID: 1115439649-0
                                    • Opcode ID: f64bbe57d7db26001b8bcd52496f9bf51d695d9bf4131af8b6190256aa5124b1
                                    • Instruction ID: e62a70fe3f4032759f7831ae8a5dccac1aa286bd5e15ac135305fab34191be9a
                                    • Opcode Fuzzy Hash: f64bbe57d7db26001b8bcd52496f9bf51d695d9bf4131af8b6190256aa5124b1
                                    • Instruction Fuzzy Hash: E5619531A0AF4289FE199B07D14423E63A4AF25FB0B0944B9CA7D277A1DF3CE4418319
                                    Function 00007FFE1330559C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 207COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: Replicator::operator[]
                                    • String ID: generic-type-$template-parameter-
                                    • API String ID: 3676697650-13229604
                                    • Opcode ID: 15e139576b22ffe1c75b7196b9f80b59ed6480602684051e6bae135f77d95c58
                                    • Instruction ID: 03a0f42be5d97d526c5160a1818fadfcbab5104e4cabf6bb9ef324160152979d
                                    • Opcode Fuzzy Hash: 15e139576b22ffe1c75b7196b9f80b59ed6480602684051e6bae135f77d95c58
                                    • Instruction Fuzzy Hash: 43917C62B0CE4ACDFB14CB62D4901BD37B1AB647A4B8011B5DE6D67BA6CE3CD416C708
                                    Function 00007FFE13274D80 Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 137networkCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692291900.00007FFE13271000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFE13270000, based on PE: true
                                    • Associated: 00000002.00000002.1692276597.00007FFE13270000.00000002.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13281000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13283000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13286000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692354101.00007FFE13287000.00000080.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692369518.00007FFE13288000.00000004.00000001.01000000.00000007.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13270000_run0796.jbxd
                                    Similarity
                                    • API ID: htonsinet_pton
                                    • String ID: %s(): AF_INET address must be tuple, not %.500s$%s(): AF_INET6 address must be tuple, not %.500s$%s(): bad family$%s(): flowinfo must be 0-1048575.$%s(): port must be 0-65535.$O&i;AF_INET address must be a pair (host, port)$O&i|II;AF_INET6 address must be a tuple (host, port[, flowinfo[, scopeid]])
                                    • API String ID: 3877577928-3646714921
                                    • Opcode ID: ef9d253bca5788aaec0f56b8a9be97946b5beeb07af36ff499633a12f8160c36
                                    • Instruction ID: 4eb2dff73f7049774fac67a3bf0c5a1891e78077641efbca94a66d9844702934
                                    • Opcode Fuzzy Hash: ef9d253bca5788aaec0f56b8a9be97946b5beeb07af36ff499633a12f8160c36
                                    • Instruction Fuzzy Hash: EC613B32A08F428AE610EF16E44467A73B0FBF5BA4F504172EA4D67AA4DF3CE545CB41
                                    Function 00007FFE133093FC Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 99COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: Name::operator+Name::operator+=Name::operator=
                                    • String ID: class $coclass $cointerface $enum $struct $union $unknown ecsu'
                                    • API String ID: 2521687178-3025788322
                                    • Opcode ID: a02d682005c4f8f87c802cf0d30af9cc80522cc67ca91cea7a7b89970b19caa2
                                    • Instruction ID: ec765d3ef0d6295705ed10caec78f46647a78e74663a324cebf94b2ca516b01b
                                    • Opcode Fuzzy Hash: a02d682005c4f8f87c802cf0d30af9cc80522cc67ca91cea7a7b89970b19caa2
                                    • Instruction Fuzzy Hash: 6D410872E18E169DE714CB66D8943BC23B0BB28764F8441B5DA2D67AB9DF3CE544C308
                                    Function 00007FFE1330A838 Relevance: 16.7, APIs: 11, Instructions: 200COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: Name::operator+$Name::operator+=$Name::operator=
                                    • String ID:
                                    • API String ID: 3504876306-0
                                    • Opcode ID: 4cf0dd5078d3509ba570865b42868e9da23906801017a10dcb0b1e26b8be7c43
                                    • Instruction ID: a6c7905216491adea0190459eaedf4514d1160e5727802e4b825e8909f212743
                                    • Opcode Fuzzy Hash: 4cf0dd5078d3509ba570865b42868e9da23906801017a10dcb0b1e26b8be7c43
                                    • Instruction Fuzzy Hash: DB919B62B14A969DFB00CFA2D8801ED37B2FB50768F404176DE5D2BAA9DF78E446C344
                                    Function 00007FFE13306A84 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 212COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: Name::operator+=Replicator::operator[]
                                    • String ID: ...$`template-parameter$void
                                    • API String ID: 2096148573-2152273162
                                    • Opcode ID: 665771c79e234ad4dc464f400d0cf3f39faa05bfa49c5029af23b19dd9380440
                                    • Instruction ID: 5bc4f397c1dfd1c10dfd9f3d9ba9de32d99fbf4be442f9f2ae3b14fcb0dd1d9f
                                    • Opcode Fuzzy Hash: 665771c79e234ad4dc464f400d0cf3f39faa05bfa49c5029af23b19dd9380440
                                    • Instruction Fuzzy Hash: 91A1A066A08F468DEA11CB27E4401BD27A0FB687B8F6041B1DA6D6377ADE3CE545D308
                                    Function 00007FFE0138FDD1 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 168libraryloaderCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: ErrorLast$AddressProcValue$Concurrency::details::_Concurrent_queue_iterator_base_v4Concurrent_queue_iterator_base_v4::~_
                                    • String ID: FlsGetValue
                                    • API String ID: 2924934987-662576866
                                    • Opcode ID: f52ed380836041d23aee315c19e5dac88337c92004505e8cead1a9440b48578b
                                    • Instruction ID: 42ad55622caf196bdce660242c3bcf7f3bf644631d3a6c53e35bd38b625bc4d4
                                    • Opcode Fuzzy Hash: f52ed380836041d23aee315c19e5dac88337c92004505e8cead1a9440b48578b
                                    • Instruction Fuzzy Hash: 0A619D60F0DB0386FB589B25A8212B863A56F497E8F460335D82E5F3F5EE3CB8458300
                                    Function 00007FFE0138D140 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 159libraryloaderCOMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00007FFE0138D2CC), ref: 00007FFE0138D14A
                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00007FFE0138D2CC), ref: 00007FFE0138D19C
                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00007FFE0138D2CC), ref: 00007FFE0138D1C1
                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00007FFE0138D2CC), ref: 00007FFE0138D207
                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,?,00007FFE0138D2CC), ref: 00007FFE0138D263
                                    • Concurrency::details::_Concurrent_queue_iterator_base_v4::~_Concurrent_queue_iterator_base_v4.LIBCPMT ref: 00007FFE013CA36E
                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00007FFE0138D2CC), ref: 00007FFE013CA375
                                    • TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,?,00007FFE0138D2CC), ref: 00007FFE013CA3DB
                                      • Part of subcall function 00007FFE0138D4D0: GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFE01393916,?,?,?,00007FFE013C7AE1,?,?,?,?,00007FFE01385036,?,?,?), ref: 00007FFE0138D549
                                      • Part of subcall function 00007FFE0138D4D0: TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00007FFE01393916,?,?,?,00007FFE013C7AE1,?,?,?,?,00007FFE01385036,?,?,?), ref: 00007FFE013C6003
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: ErrorLast$AddressProcValue$Concurrency::details::_Concurrent_queue_iterator_base_v4Concurrent_queue_iterator_base_v4::~_
                                    • String ID: FlsGetValue
                                    • API String ID: 2924934987-662576866
                                    • Opcode ID: 4e3376b875426cc0c2da9dad461cceea9f39f7fcaf12e3b06dfc2c35fe93cecf
                                    • Instruction ID: 85917878843cbf285a3d349ebdf0448db8934499f11f3d6dddb99ee74cca8616
                                    • Opcode Fuzzy Hash: 4e3376b875426cc0c2da9dad461cceea9f39f7fcaf12e3b06dfc2c35fe93cecf
                                    • Instruction Fuzzy Hash: CD51CD20F0D70786FB549BA5A9611BC63A5AF897A8F460234E91D4F7F6EE7CF8458300
                                    Function 00007FFE0138CC80 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 159libraryloaderCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00007FFE0138CE0C), ref: 00007FFE0138CC8A
                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00007FFE0138CE0C), ref: 00007FFE0138CCDC
                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00007FFE0138CE0C), ref: 00007FFE0138CD01
                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00007FFE0138CE0C), ref: 00007FFE0138CD47
                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,?,00007FFE0138CE0C), ref: 00007FFE0138CDA3
                                    • Concurrency::details::_Concurrent_queue_iterator_base_v4::~_Concurrent_queue_iterator_base_v4.LIBCPMT ref: 00007FFE013CA1C2
                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00007FFE0138CE0C), ref: 00007FFE013CA1C9
                                    • TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,?,00007FFE0138CE0C), ref: 00007FFE013CA22F
                                      • Part of subcall function 00007FFE0138D4D0: GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFE01393916,?,?,?,00007FFE013C7AE1,?,?,?,?,00007FFE01385036,?,?,?), ref: 00007FFE0138D549
                                      • Part of subcall function 00007FFE0138D4D0: TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00007FFE01393916,?,?,?,00007FFE013C7AE1,?,?,?,?,00007FFE01385036,?,?,?), ref: 00007FFE013C6003
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: ErrorLast$AddressProcValue$Concurrency::details::_Concurrent_queue_iterator_base_v4Concurrent_queue_iterator_base_v4::~_
                                    • String ID: FlsGetValue
                                    • API String ID: 2924934987-662576866
                                    • Opcode ID: d6434e662464deee8233572b9f92d953cb998a06bf3648825ffe5b64189818c6
                                    • Instruction ID: 6eefbb828124f9b5461e23df1f54885e63b84afc095be1aa64140c2dabd23070
                                    • Opcode Fuzzy Hash: d6434e662464deee8233572b9f92d953cb998a06bf3648825ffe5b64189818c6
                                    • Instruction Fuzzy Hash: 84519B20F0D70786FB14AB65A9511BC63A5AF897A8F461634E91E4F7F6EE3CF8458300
                                    Function 00007FFE0138C4B0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 156libraryloaderCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00007FFE0138C499), ref: 00007FFE0138C4BA
                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00007FFE0138C499), ref: 00007FFE0138C50C
                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00007FFE0138C499), ref: 00007FFE0138C531
                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00007FFE0138C499), ref: 00007FFE0138C577
                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,?,00007FFE0138C499), ref: 00007FFE0138C5D3
                                    • Concurrency::details::_Concurrent_queue_iterator_base_v4::~_Concurrent_queue_iterator_base_v4.LIBCPMT ref: 00007FFE013C9FF6
                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00007FFE0138C499), ref: 00007FFE013C9FFD
                                      • Part of subcall function 00007FFE0138D4D0: GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFE01393916,?,?,?,00007FFE013C7AE1,?,?,?,?,00007FFE01385036,?,?,?), ref: 00007FFE0138D549
                                      • Part of subcall function 00007FFE0138D4D0: TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00007FFE01393916,?,?,?,00007FFE013C7AE1,?,?,?,?,00007FFE01385036,?,?,?), ref: 00007FFE013C6003
                                    • TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,?,00007FFE0138C499), ref: 00007FFE013CA063
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: ErrorLast$AddressProcValue$Concurrency::details::_Concurrent_queue_iterator_base_v4Concurrent_queue_iterator_base_v4::~_
                                    • String ID: FlsGetValue
                                    • API String ID: 2924934987-662576866
                                    • Opcode ID: a6e727784818a43a95466b9ad5db6175986da5091dc0bed355263e2ac5cf96a3
                                    • Instruction ID: 5d261a7f7fb5f64dc512e244e5f565d84e87c92219d3c1c6bdba8c65d1dcbe71
                                    • Opcode Fuzzy Hash: a6e727784818a43a95466b9ad5db6175986da5091dc0bed355263e2ac5cf96a3
                                    • Instruction Fuzzy Hash: 0451DD20B09B4386EB149B66E9501BC63A4AF49BE8F050235ED1D5F7F6EE3CF8458300
                                    Function 00007FFE01389D30 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 152libraryloaderCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,?,?,?,00007FFE01421E7C,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE01389D3A
                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00007FFE01421E7C,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE01389D8C
                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00007FFE01421E7C,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE01389DB1
                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00007FFE01421E7C,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE01389DF7
                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,00007FFE01421E7C,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE01389E4F
                                    • Concurrency::details::_Concurrent_queue_iterator_base_v4::~_Concurrent_queue_iterator_base_v4.LIBCPMT ref: 00007FFE013C8B1A
                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00007FFE01421E7C,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE013C8B21
                                    • TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,00007FFE01421E7C,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FFE013C8B87
                                      • Part of subcall function 00007FFE0138D4D0: GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFE01393916,?,?,?,00007FFE013C7AE1,?,?,?,?,00007FFE01385036,?,?,?), ref: 00007FFE0138D549
                                      • Part of subcall function 00007FFE0138D4D0: TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00007FFE01393916,?,?,?,00007FFE013C7AE1,?,?,?,?,00007FFE01385036,?,?,?), ref: 00007FFE013C6003
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: ErrorLast$AddressProcValue$Concurrency::details::_Concurrent_queue_iterator_base_v4Concurrent_queue_iterator_base_v4::~_
                                    • String ID: FlsGetValue
                                    • API String ID: 2924934987-662576866
                                    • Opcode ID: f2329266c236cee3302473edb8e7c83319f9b1b8437158587f5ec80500eb432a
                                    • Instruction ID: ab3e93f059cfa932ec062f92fd536ec0d5cbbb35a3a7f520cb74de62845dfe63
                                    • Opcode Fuzzy Hash: f2329266c236cee3302473edb8e7c83319f9b1b8437158587f5ec80500eb432a
                                    • Instruction Fuzzy Hash: E4519860B0DB038AFB149B65E96127C63A5AF887A8F060635D91E5F7F5EE3CF9058300
                                    Function 00007FFE0138D360 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 143libraryloaderCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00007FFE0138D5A8), ref: 00007FFE0138D36A
                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00007FFE0138D5A8), ref: 00007FFE0138D3BC
                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00007FFE0138D5A8), ref: 00007FFE0138D3E1
                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00007FFE0138D5A8), ref: 00007FFE0138D427
                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,?,00007FFE0138D5A8), ref: 00007FFE0138D487
                                    • Concurrency::details::_Concurrent_queue_iterator_base_v4::~_Concurrent_queue_iterator_base_v4.LIBCPMT ref: 00007FFE013CA446
                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,00007FFE0138D5A8), ref: 00007FFE013CA44D
                                    • TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,?,00007FFE0138D5A8), ref: 00007FFE013CA4B3
                                      • Part of subcall function 00007FFE0138D4D0: GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFE01393916,?,?,?,00007FFE013C7AE1,?,?,?,?,00007FFE01385036,?,?,?), ref: 00007FFE0138D549
                                      • Part of subcall function 00007FFE0138D4D0: TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00007FFE01393916,?,?,?,00007FFE013C7AE1,?,?,?,?,00007FFE01385036,?,?,?), ref: 00007FFE013C6003
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: ErrorLast$AddressProcValue$Concurrency::details::_Concurrent_queue_iterator_base_v4Concurrent_queue_iterator_base_v4::~_
                                    • String ID: FlsGetValue
                                    • API String ID: 2924934987-662576866
                                    • Opcode ID: 77fce9172f88cbdad6ddcaee4a143c95107f181c30401ff31f0dab345b65509d
                                    • Instruction ID: cf1056bf62878b080f708b5dbcb585367f6563acce3bb15e4976d021c681e7e0
                                    • Opcode Fuzzy Hash: 77fce9172f88cbdad6ddcaee4a143c95107f181c30401ff31f0dab345b65509d
                                    • Instruction Fuzzy Hash: E651BF20B0DB0386FB549B65E9651BC63A5AF497A8F450234D91E6F7F5EE3CF8058301
                                    Function 00007FFE1330C3B0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 140COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: Free__vcrt_uninitialize_locks$LibraryValue_free_base
                                    • String ID: FlsFree$FlsGetValue$__based(
                                    • API String ID: 2814451518-2927404567
                                    • Opcode ID: f6cfbe63c062ea6287187b3eb5a9fe17c3e4f29cae45bc5e4672bc025ee94fd5
                                    • Instruction ID: aa0ba404f87c431b6987d5bd563e8ec8f034aab8fbc5094cc15a88e3f0df7788
                                    • Opcode Fuzzy Hash: f6cfbe63c062ea6287187b3eb5a9fe17c3e4f29cae45bc5e4672bc025ee94fd5
                                    • Instruction Fuzzy Hash: 5C519E61E09F038EEE55AB57A84017C62A2AF64770F4402B5D97E777F6DE2CE846830C
                                    Function 00007FFE13304A20 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 127libraryloaderCOMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • GetProcAddress.KERNEL32(?,?,00000000,00007FFE13304945,?,?,?,00007FFE13301831), ref: 00007FFE13304B7A
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: AddressProc
                                    • String ID: api-ms-$ext-ms-
                                    • API String ID: 190572456-537541572
                                    • Opcode ID: 305ed8650c29c88a46931ba75e192595f887792d6ebc16c8c7e4d4d625547515
                                    • Instruction ID: 43089e1e9a61505f1228caf31cad6c5a1c12556cff6f426caf18bbaa865131c7
                                    • Opcode Fuzzy Hash: 305ed8650c29c88a46931ba75e192595f887792d6ebc16c8c7e4d4d625547515
                                    • Instruction Fuzzy Hash: 0A412361B09E0289FA15DB13A9443B96391BF24BF0F0845B5CD7DBB3A4EE3CE1058748
                                    Function 00007FFE13302D60 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 124COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: abort
                                    • String ID: csm
                                    • API String ID: 4206212132-1018135373
                                    • Opcode ID: f7736b398cdf48044678fa18456032d209415373489a7dee373e069894c23483
                                    • Instruction ID: e24519857790433d554f2cc53c8f588df2976bc65ba12cf7f2b8d6932363c384
                                    • Opcode Fuzzy Hash: f7736b398cdf48044678fa18456032d209415373489a7dee373e069894c23483
                                    • Instruction Fuzzy Hash: B8518132A08F428AEA649B13E44016D63A4FF68BB4F1006B5DE6D63B75DF3CE461C709
                                    Function 00007FFE1330A690 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 109COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: Name::operator+$Name::operator+=$Name::operator=
                                    • String ID: cli::array<$cli::pin_ptr<$std::nullptr_t$std::nullptr_t $void$void
                                    • API String ID: 3504876306-2239912363
                                    • Opcode ID: fb905b2f36ee6f8e76145deec34df325946bc174dcf074b8bb2b93575c82a950
                                    • Instruction ID: 3de4f35fe024d2d90b41bebadf867d98e5da65ebe2da7e1952a8e2d12216a2d6
                                    • Opcode Fuzzy Hash: fb905b2f36ee6f8e76145deec34df325946bc174dcf074b8bb2b93575c82a950
                                    • Instruction Fuzzy Hash: 99517572E08F569CFB11CB62E8401BD37B4BB24BA4F4085B5EA2D227A5DF7C9546C704
                                    Function 00007FFE13301D48 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 203COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: abort$terminate
                                    • String ID: csm$csm
                                    • API String ID: 579254285-3733052814
                                    • Opcode ID: bf2bd8ebdab93d80cc5c3377118db6f6a4f09d09715ac30f3a7fa679fbe568cb
                                    • Instruction ID: 7aac219828dd63f1d345f6c90eff95f96fbd49eb39a322c91557898ad70f8b80
                                    • Opcode Fuzzy Hash: bf2bd8ebdab93d80cc5c3377118db6f6a4f09d09715ac30f3a7fa679fbe568cb
                                    • Instruction Fuzzy Hash: DA819336E08E428AEA349B57958477DA690BB64BA5F044275CB6D23BB2CF3CE451C708
                                    Function 00007FFE1330AB24 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 126COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: Name::operator+$Name::operator+=$Name::operator=
                                    • String ID: {for
                                    • API String ID: 3504876306-864106941
                                    • Opcode ID: 1c92e329c404754517839ad3aba3f804cdfa7fe5de4e7f1074ce51ab54e1b3f4
                                    • Instruction ID: 36991d0ae3b1f38d15f4e3c18af1b8f7e7085f75aa2ee04bebba9466514071aa
                                    • Opcode Fuzzy Hash: 1c92e329c404754517839ad3aba3f804cdfa7fe5de4e7f1074ce51ab54e1b3f4
                                    • Instruction Fuzzy Hash: AB516C72A08E459DFB01CB66D8403ED27A1BB247A4F8440B1DA6D67BA6CF7CE485C348
                                    Function 00007FFE133037D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 75COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: abort
                                    • String ID: csm
                                    • API String ID: 4206212132-1018135373
                                    • Opcode ID: cee6b53f9be09bf52de3ade6e9bb4be5d591decda02f78e2ecb72a162e3db562
                                    • Instruction ID: 5eb52bb924837eb2f60129d0c84d077bce86f60e5e29451edf3c8a2fda1aaec5
                                    • Opcode Fuzzy Hash: cee6b53f9be09bf52de3ade6e9bb4be5d591decda02f78e2ecb72a162e3db562
                                    • Instruction Fuzzy Hash: 84312231D09F428AFA585B52D08423E22A4EF78B76F140AF5CA3C227E1DF3CE4548659
                                    Function 00007FFE013BD374 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 69COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: NameName::Name::operator+Name::operator=
                                    • String ID: char $int $long $short $unsigned
                                    • API String ID: 2383713746-3894466517
                                    • Opcode ID: d821475bbf388ec6fe5dfc2d78fea0b03bb5bbd43309547eec5bbefa909cfc05
                                    • Instruction ID: 3b706c883c743c522d2d40230567cb2e6d6ba768f6cc609b3ed49d8303f7633f
                                    • Opcode Fuzzy Hash: d821475bbf388ec6fe5dfc2d78fea0b03bb5bbd43309547eec5bbefa909cfc05
                                    • Instruction Fuzzy Hash: 95313832E19A5699EB008FA8E8C01F837B1AB4475CB994032DB4D5B2BAEF7CE541C714
                                    Function 00007FFE013BBBE4 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 66COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: ArgumentDecorator::getListNameName::Name::operator+Name::operator+=
                                    • String ID: ,...$,<ellipsis>$...$<ellipsis>$void
                                    • API String ID: 2164699225-2211150622
                                    • Opcode ID: 4a4bb6859b1cf1c336275f23dabc32d47eb2a2d6a5ffe25e480bef53d4d94cd4
                                    • Instruction ID: 516802f4ea9f0b87d7b39e011224e38c1835aa4ae10cc818e951d7925ea9d162
                                    • Opcode Fuzzy Hash: 4a4bb6859b1cf1c336275f23dabc32d47eb2a2d6a5ffe25e480bef53d4d94cd4
                                    • Instruction Fuzzy Hash: DA315372909B8799FB11CB14E8801B977A4EB48798F998031C68D4F3B9EFBCE941C711
                                    Function 00007FFE013815A0 Relevance: 13.8, APIs: 9, Instructions: 282fileCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00007FFE01381844: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,00007FFE0138161E), ref: 00007FFE01381864
                                      • Part of subcall function 00007FFE01381844: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,00007FFE0138161E), ref: 00007FFE013818BA
                                      • Part of subcall function 00007FFE01381844: LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,00007FFE0138161E), ref: 00007FFE01381948
                                    • CreateFileW.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FFE0138167D
                                    • GetFileType.API-MS-WIN-CORE-FILE-L1-1-0 ref: 00007FFE0138169B
                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE0138182C
                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE013C6296
                                    • CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0 ref: 00007FFE013C62C9
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: CriticalSection$EnterErrorFileLast$CloseCreateHandleLeaveType
                                    • String ID:
                                    • API String ID: 3788438030-0
                                    • Opcode ID: 527d567c00684b35144dbc2424836a878e2d970a9eb86903730408bd2a2d3b2c
                                    • Instruction ID: 9551d807324a2c670c17f9e18c7c1e31e4cd3bcdb47b96c7508b2fb971846af1
                                    • Opcode Fuzzy Hash: 527d567c00684b35144dbc2424836a878e2d970a9eb86903730408bd2a2d3b2c
                                    • Instruction Fuzzy Hash: 6FC1D076B28B418AEB10CF69D4811AD37B1EB49B98B061239DE6E5B7E5CF3CD416C300
                                    Function 00007FFE013F0A3C Relevance: 13.6, APIs: 9, Instructions: 80threadCOMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: ErrorLast$ExitThread$Concurrency::details::_Concurrent_queue_iterator_base_v4Concurrent_queue_iterator_base_v4::~_
                                    • String ID:
                                    • API String ID: 2407257114-0
                                    • Opcode ID: a82bbfc26a4f87a68aab9730668b4fbc3fc0cbb5762d8adda0e6baaf70d74d42
                                    • Instruction ID: 744a3d3f422da655e59f8f4e3e365d2573920b247c76d30ee2821d562c9186b9
                                    • Opcode Fuzzy Hash: a82bbfc26a4f87a68aab9730668b4fbc3fc0cbb5762d8adda0e6baaf70d74d42
                                    • Instruction Fuzzy Hash: 52315E20B0CA4342FF596B74995427D62A6AF40BB8F564338E53E1F6F6DF6CE8058340
                                    Function 00007FFE01389EC0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 142libraryloaderCOMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFE013854DE,?,?,?,00007FFE013853F1,?,?,?,?,?,?,?,00007FFE0138532D), ref: 00007FFE01389EC8
                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00007FFE013854DE,?,?,?,00007FFE013853F1,?,?,?,?,?,?,?,00007FFE0138532D), ref: 00007FFE01389F50
                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,00007FFE013854DE,?,?,?,00007FFE013853F1,?,?,?,?,?,?,?,00007FFE0138532D), ref: 00007FFE01389FA2
                                    • Concurrency::details::_Concurrent_queue_iterator_base_v4::~_Concurrent_queue_iterator_base_v4.LIBCPMT ref: 00007FFE013C5F56
                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00007FFE013854DE,?,?,?,00007FFE013853F1,?,?,?,?,?,?,?,00007FFE0138532D), ref: 00007FFE013C5F5D
                                    • TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,00007FFE013854DE,?,?,?,00007FFE013853F1,?,?,?,?,?,?,?,00007FFE0138532D), ref: 00007FFE013C5FC3
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: ErrorLast$AddressConcurrency::details::_Concurrent_queue_iterator_base_v4Concurrent_queue_iterator_base_v4::~_ProcValue
                                    • String ID: FlsGetValue
                                    • API String ID: 2828593425-662576866
                                    • Opcode ID: 7ebf263ede67ec0f7268489d2c9e8204356379416a53b3ccdee963751b19d755
                                    • Instruction ID: 861d1037c2310660f54c8f8ce1816106c2caa6599e8b8bacad0ddb4053a9c732
                                    • Opcode Fuzzy Hash: 7ebf263ede67ec0f7268489d2c9e8204356379416a53b3ccdee963751b19d755
                                    • Instruction Fuzzy Hash: 63518F61B0DB0386FB189B25A95427D63A1AF897E8F554235E91E0F7F5EE3CF8098300
                                    Function 00007FFE132759C0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 117networkCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692291900.00007FFE13271000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFE13270000, based on PE: true
                                    • Associated: 00000002.00000002.1692276597.00007FFE13270000.00000002.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13281000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13283000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13286000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692354101.00007FFE13287000.00000080.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692369518.00007FFE13288000.00000004.00000001.01000000.00000007.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13270000_run0796.jbxd
                                    Similarity
                                    • API ID: ErrorLast
                                    • String ID: timed out
                                    • API String ID: 1452528299-3163636755
                                    • Opcode ID: 82681b19adf6d6ad467b42a6fe9b12e27ddc8409e2936538c2157e22f345ca03
                                    • Instruction ID: 884091f2ed682ff7888fe11fb16bc6cb0d98f264ca671a33b24eac3f7a95be01
                                    • Opcode Fuzzy Hash: 82681b19adf6d6ad467b42a6fe9b12e27ddc8409e2936538c2157e22f345ca03
                                    • Instruction Fuzzy Hash: A4414521E08E92CEF7657B679448279A250BFF4B70F2451B0CD4E666B4DF3CE885C250
                                    Function 00007FFE13276044 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 113networkCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692291900.00007FFE13271000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFE13270000, based on PE: true
                                    • Associated: 00000002.00000002.1692276597.00007FFE13270000.00000002.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13281000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13283000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13286000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692354101.00007FFE13287000.00000080.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692369518.00007FFE13288000.00000004.00000001.01000000.00000007.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13270000_run0796.jbxd
                                    Similarity
                                    • API ID: Ioctl
                                    • String ID: invalid ioctl command %lu$k(kkk):ioctl$kI:ioctl$kO:ioctl
                                    • API String ID: 3041054344-4238462244
                                    • Opcode ID: 35bebcf9f928722b537939ffd19b7844e575b288c7ec719cf6e9efdd61baafbd
                                    • Instruction ID: b291201323ec067b58ba2c2cf68cac7a3d746993675c17b3abcb428c61c18043
                                    • Opcode Fuzzy Hash: 35bebcf9f928722b537939ffd19b7844e575b288c7ec719cf6e9efdd61baafbd
                                    • Instruction Fuzzy Hash: AB514C32B18E428DE760DF66E8405ED37B0FBA8768F544172EA4EA3A68DF38D554C700
                                    Function 00007FFE013BD0AC Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 104COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: NameName::$Name::doName::operator+Pchar
                                    • String ID: `non-type-template-parameter
                                    • API String ID: 3026640183-4247534891
                                    • Opcode ID: 9437e4a2bc65fd9331940d40897d9c76a7f7037035a9de6aae8135c60e2ad8b3
                                    • Instruction ID: 6d9d544bbf69f77e600ae5c4f9dbf24a9b5c037166f7fc281f2deae97fefc274
                                    • Opcode Fuzzy Hash: 9437e4a2bc65fd9331940d40897d9c76a7f7037035a9de6aae8135c60e2ad8b3
                                    • Instruction Fuzzy Hash: 0A418E32A08A9699E740CB61D9C01BD37A4BB51B88F568031DB4E1BBB5EF3CE9168300
                                    Function 00007FFE133085E0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 74COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: Name::operator+Name::operator=
                                    • String ID: char $int $long $short $unsigned
                                    • API String ID: 1492653461-3894466517
                                    • Opcode ID: c0b7dbe21b8175da4614ce5a65b82f07a77ab9efeaa9dba654015b5c321106f4
                                    • Instruction ID: 1204c8ff38baeb8a8f7c5266f652a13beddd376aa0f2455bbe2c7cc801014bc1
                                    • Opcode Fuzzy Hash: c0b7dbe21b8175da4614ce5a65b82f07a77ab9efeaa9dba654015b5c321106f4
                                    • Instruction Fuzzy Hash: 2E316372E18E4E8DFB108B29D4443BD37B0A724768F944171CA6C6A6B6CF3CD445C708
                                    Function 00007FFE133048F4 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 65COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: ErrorLast
                                    • String ID: FlsGetValue$__based(
                                    • API String ID: 1452528299-1499225077
                                    • Opcode ID: 667999330e637d529fa0c4ead2f56afba722f0e302c095185809fe3dbf1186dd
                                    • Instruction ID: 4b7763501b5c78edeef6cb491c2764a2839394e8cb8d31413cb286acdc52a232
                                    • Opcode Fuzzy Hash: 667999330e637d529fa0c4ead2f56afba722f0e302c095185809fe3dbf1186dd
                                    • Instruction Fuzzy Hash: 1F212120F0DF0289FA549B63A94417D1291AF68BB0F5446B5D9BD333F5DE3CE5018B58
                                    Function 00007FFE013BCE04 Relevance: 12.2, APIs: 8, Instructions: 183COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • UnDecorator::getDataType.LIBVCRUNTIME ref: 00007FFE013BCE35
                                      • Part of subcall function 00007FFE013BCD1C: DName::DName.LIBVCRUNTIME ref: 00007FFE013BCD30
                                    • UnDecorator::getTemplateName.LIBVCRUNTIME ref: 00007FFE013BCEAA
                                      • Part of subcall function 00007FFE013BFB68: UnDecorator::getTemplateArgumentList.LIBVCRUNTIME ref: 00007FFE013BFC6C
                                      • Part of subcall function 00007FFE013BFB68: DName::doPchar.LIBVCRUNTIME ref: 00007FFE013BFC95
                                      • Part of subcall function 00007FFE013BFB68: DName::operator+.LIBVCRUNTIME ref: 00007FFE013BFCA7
                                      • Part of subcall function 00007FFE013BFB68: DName::operator+=.LIBVCRUNTIME ref: 00007FFE013BFCB6
                                      • Part of subcall function 00007FFE013BFB68: DName::operator+=.LIBVCRUNTIME ref: 00007FFE013BFCDD
                                      • Part of subcall function 00007FFE013BFB68: DName::operator+=.LIBVCRUNTIME ref: 00007FFE013BFCE9
                                    • UnDecorator::getScope.LIBVCRUNTIME ref: 00007FFE013BCF21
                                      • Part of subcall function 00007FFE013BEBB8: DName::DName.LIBVCRUNTIME ref: 00007FFE013BEC1B
                                      • Part of subcall function 00007FFE013BEBB8: DName::operator+.LIBVCRUNTIME ref: 00007FFE013BEC2A
                                      • Part of subcall function 00007FFE013BEBB8: DName::doPchar.LIBVCRUNTIME ref: 00007FFE013BEC64
                                      • Part of subcall function 00007FFE013BEBB8: DName::operator+.LIBVCRUNTIME ref: 00007FFE013BEC75
                                      • Part of subcall function 00007FFE013BEBB8: UnDecorator::getLexicalFrame.LIBVCRUNTIME ref: 00007FFE013BECDE
                                      • Part of subcall function 00007FFE013BEBB8: DName::operator+.LIBVCRUNTIME ref: 00007FFE013BEF89
                                    • UnDecorator::getScope.LIBVCRUNTIME ref: 00007FFE013BCF6F
                                      • Part of subcall function 00007FFE013BEBB8: DName::operator+.LIBVCRUNTIME ref: 00007FFE013BED30
                                      • Part of subcall function 00007FFE013BEBB8: DName::operator+.LIBVCRUNTIME ref: 00007FFE013BED41
                                      • Part of subcall function 00007FFE013BEBB8: DName::doPchar.LIBVCRUNTIME ref: 00007FFE013BED9F
                                      • Part of subcall function 00007FFE013BEBB8: DName::operator+.LIBVCRUNTIME ref: 00007FFE013BEDB2
                                      • Part of subcall function 00007FFE013BEBB8: DName::operator+.LIBVCRUNTIME ref: 00007FFE013BEDC2
                                    • DName::operator+.LIBVCRUNTIME ref: 00007FFE013BCF90
                                      • Part of subcall function 00007FFE013BA9E8: DName::operator+=.LIBCMT ref: 00007FFE013BAA03
                                    • DName::operator+.LIBVCRUNTIME ref: 00007FFE013BCF4D
                                      • Part of subcall function 00007FFE013BA990: DName::operator+=.LIBVCRUNTIME ref: 00007FFE013BA9AB
                                    • DName::operator+.LIBVCRUNTIME ref: 00007FFE013BCFA0
                                    • DName::operator+.LIBVCRUNTIME ref: 00007FFE013BCFC3
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: Name::operator+$Decorator::get$Name::operator+=$NameName::doPchar$Name::ScopeTemplate$ArgumentDataFrameLexicalListType
                                    • String ID:
                                    • API String ID: 3834373156-0
                                    • Opcode ID: 0a18e5a26053d17071ef86c64d2d77fcaa9b6bc53dcfc16718ce00805e0ab38e
                                    • Instruction ID: 245390e18cfa49625f610e826da28cddc03cdcf47f38f4fae9e43c80584f6b9a
                                    • Opcode Fuzzy Hash: 0a18e5a26053d17071ef86c64d2d77fcaa9b6bc53dcfc16718ce00805e0ab38e
                                    • Instruction Fuzzy Hash: 63916A72E0866299FB21CBA0D8807BC37B0BB44798F565035DB4D1BAB9EF7CA845C340
                                    Function 00007FFE13302BFD Relevance: 12.1, APIs: 8, Instructions: 88COMMON
                                    Download Yara Rule
                                    APIs
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000000,?,00007FFE13301EE3), ref: 00007FFE13302AED
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000000,?,00007FFE13301EE3), ref: 00007FFE13302B16
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000000,?,00007FFE13301EE3), ref: 00007FFE13302B38
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000000,?,00007FFE13301EE3), ref: 00007FFE13302B4C
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000000,?,00007FFE13301EE3), ref: 00007FFE13302B86
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000000,?,00007FFE13301EE3), ref: 00007FFE13302BA8
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000000,?,00007FFE13301EE3), ref: 00007FFE13302BBC
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000000,?,00007FFE13301EE3), ref: 00007FFE13302BF1
                                    • terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000000,?,00007FFE13301EE3), ref: 00007FFE13302C24
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000000,?,00007FFE13301EE3), ref: 00007FFE13302C35
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000000,?,00007FFE13301EE3), ref: 00007FFE13302C4C
                                    • terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000000,?,00007FFE13301EE3), ref: 00007FFE13302C60
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: abort$terminate
                                    • String ID:
                                    • API String ID: 579254285-0
                                    • Opcode ID: e3977c0a68af9ce3eb6a72269560602cc14ed44f0c0cc47add408e7440dde568
                                    • Instruction ID: eeb4163f60b340fea9183610b902b9b0ee1bad564ca8a68cfb68fce45425ce94
                                    • Opcode Fuzzy Hash: e3977c0a68af9ce3eb6a72269560602cc14ed44f0c0cc47add408e7440dde568
                                    • Instruction Fuzzy Hash: 7E416E31A09F428AEA24AF52C18423C6750FFA8B65F0148B6CA2D637B1CF3CF4058719
                                    Function 00007FFE13308900 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 152COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: Name::operator+$Name::operator=$Name::operator+=
                                    • String ID: std::nullptr_t$std::nullptr_t $volatile
                                    • API String ID: 3335366782-294867888
                                    • Opcode ID: 010d4b62d375ba577e931595fce58cfe727f9f4233cb7cc30c07a584e04d8d6a
                                    • Instruction ID: 6ae90f5c435555eeda6851a1ad5f0f7267c39b1a616baddbbcb53f7518e57693
                                    • Opcode Fuzzy Hash: 010d4b62d375ba577e931595fce58cfe727f9f4233cb7cc30c07a584e04d8d6a
                                    • Instruction Fuzzy Hash: DE614EB2A09E128CFB14DF6698500BD7B64FB24BA4B4445B6DA6D67B76CF3CE150C308
                                    Function 00007FFE013BD470 Relevance: 10.6, APIs: 7, Instructions: 143COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: Name::doName::operator+Pchar$NameName::
                                    • String ID:
                                    • API String ID: 2855847547-0
                                    • Opcode ID: 66bec9f24421dfbb8cab4e91a47ebe9cacb65c8cd85f5c7411ffbc5a3a6c849d
                                    • Instruction ID: bc3df60cb3d9680598fc22c153bfe8ce3f0e21876a3f65a2eb334879c7bb8e54
                                    • Opcode Fuzzy Hash: 66bec9f24421dfbb8cab4e91a47ebe9cacb65c8cd85f5c7411ffbc5a3a6c849d
                                    • Instruction Fuzzy Hash: 55616B72A08B6699E710CF64E8802AC3BB5EB44B9CF958036DA4D1B7B9EF7DD441C300
                                    Function 00007FFE133066F4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: NameName::$Name::operator+
                                    • String ID: `non-type-template-parameter
                                    • API String ID: 826178784-4247534891
                                    • Opcode ID: 27f7340d07b8a53ae54682156064714a75510f143d49d5ded7006f5a180fbb92
                                    • Instruction ID: 04b52d558cea925d79ee3f3d8018cafaf4b3cbcc24df5dd28363977753fbd7ef
                                    • Opcode Fuzzy Hash: 27f7340d07b8a53ae54682156064714a75510f143d49d5ded7006f5a180fbb92
                                    • Instruction Fuzzy Hash: 07419172A08F9689FB00CF26D5901BC37A5FB24BB0B6040B5DA6D77BA9CF38E4559304
                                    Function 00007FFE13276DE0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 84COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692291900.00007FFE13271000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFE13270000, based on PE: true
                                    • Associated: 00000002.00000002.1692276597.00007FFE13270000.00000002.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13281000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13283000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13286000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692354101.00007FFE13287000.00000080.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692369518.00007FFE13288000.00000004.00000001.01000000.00000007.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13270000_run0796.jbxd
                                    Similarity
                                    • API ID: setsockopt
                                    • String ID: iiO!I:setsockopt$iii:setsockopt$iiy*:setsockopt$socket option is larger than %i bytes
                                    • API String ID: 3981526788-1608436615
                                    • Opcode ID: 93fb85785a50827721e562a3685a17cbd384e858c3abe8704143fb68ac91661e
                                    • Instruction ID: e51eed9a3c671664a4d61a99826638f761e4af69b70eb0379d86b042d4173848
                                    • Opcode Fuzzy Hash: 93fb85785a50827721e562a3685a17cbd384e858c3abe8704143fb68ac91661e
                                    • Instruction Fuzzy Hash: 7F410D32608F868ADB209F22E4447AA7370FBE8BA4F504272DA9D53764DF3DD509C740
                                    Function 00007FFE133044B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 82stringCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: _free_base$EntryInterlockedListPush_malloc_basestrcpy_s
                                    • String ID:
                                    • API String ID: 3559411272-3916222277
                                    • Opcode ID: 674afff8a306edbd1bdf95ce54468db4187de9c58b16d10f99e37dc01cd62d32
                                    • Instruction ID: 6d85df2f38b01bc213f21182dca4c1e6d467ddf6c3ccfd35d3dd49a05ff6950e
                                    • Opcode Fuzzy Hash: 674afff8a306edbd1bdf95ce54468db4187de9c58b16d10f99e37dc01cd62d32
                                    • Instruction Fuzzy Hash: C731D022719F4589EB05CF66A80856D63A0FB18FF4B484674DE7D633A0EE3CE946C704
                                    Function 00007FFE01386448 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 71libraryCOMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • LoadLibraryExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFE01388B96,?,?,?,00007FFE013CD813,?,?,?,00007FFE013C7AE1), ref: 00007FFE013864B2
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: LibraryLoad
                                    • String ID: api-ms-$ext-ms-
                                    • API String ID: 1029625771-537541572
                                    • Opcode ID: e56abf4f5901805250e51f2b17b391fbea24d086396af2ae22ca12f96b6131e8
                                    • Instruction ID: dd3b5d706f4807a5f2211b34caa2f23064a29e58bbb5305b71ca831ea7dcfc0f
                                    • Opcode Fuzzy Hash: e56abf4f5901805250e51f2b17b391fbea24d086396af2ae22ca12f96b6131e8
                                    • Instruction Fuzzy Hash: 6C218B21B1AB8285EF259B1A985017C32A5BF49BA4F5A0635DE2E5F7F1DF3CE0098740
                                    Function 00007FFE13308B6C Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 69COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • UnDecorator::getArgumentList.LIBVCRUNTIME ref: 00007FFE13308B93
                                      • Part of subcall function 00007FFE13308C80: Replicator::operator[].LIBVCRUNTIME ref: 00007FFE13308CFE
                                      • Part of subcall function 00007FFE13308C80: DName::operator+=.LIBVCRUNTIME ref: 00007FFE13308D09
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: ArgumentDecorator::getListName::operator+=Replicator::operator[]
                                    • String ID: ,...$,<ellipsis>$...$<ellipsis>$void
                                    • API String ID: 98997111-2211150622
                                    • Opcode ID: 7b61e257d67e4074b012ee781fd519160f23a95b3b10d6e0f956f18611d2db91
                                    • Instruction ID: 7d53d090e4a01d4eb9e53bfbdd6fb5a76e8b190f21ecc3bd0e994c76092fe5ff
                                    • Opcode Fuzzy Hash: 7b61e257d67e4074b012ee781fd519160f23a95b3b10d6e0f956f18611d2db91
                                    • Instruction Fuzzy Hash: A1316BA2909F8A8EFB118B16E84036D77F0EB24765F9481B5D55D6A372CF3CE445C708
                                    Function 00007FFE013BBF3C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 52COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: Name::operator+=$Name::operator+$Decorator::getNameName::Name::operator=Scope
                                    • String ID: void
                                    • API String ID: 3122822510-3531332078
                                    • Opcode ID: e60bfcba61d4e27f84fc130301ff8f00a6e4c99a935fd141718b71362ba95a11
                                    • Instruction ID: 147d8da2bb62965ee1fc254d7e68e4fca7e653a9e887a97261e372ddc5f1bb4e
                                    • Opcode Fuzzy Hash: e60bfcba61d4e27f84fc130301ff8f00a6e4c99a935fd141718b71362ba95a11
                                    • Instruction Fuzzy Hash: BE21847291C98395EB20CB24D8D0179B3A1FF94788F558032E68D8F2B9FE6DE549CB01
                                    Function 00007FFE13277D48 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 50networkCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692291900.00007FFE13271000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFE13270000, based on PE: true
                                    • Associated: 00000002.00000002.1692276597.00007FFE13270000.00000002.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13281000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13283000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13286000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692354101.00007FFE13287000.00000080.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692369518.00007FFE13288000.00000004.00000001.01000000.00000007.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13270000_run0796.jbxd
                                    Similarity
                                    • API ID: getservbyporthtons
                                    • String ID: getservbyport: port must be 0-65535.$i|s:getservbyport$port/proto not found$socket.getservbyport
                                    • API String ID: 3477891686-2618607128
                                    • Opcode ID: dc0349f3359b55ac83e25c3837a107be034ff85053e3974c30154b6231f7094c
                                    • Instruction ID: e78559598eda4f6098dd4eb6bfe405c1e68f0f284dff22a7172b4b1f0f8c09e5
                                    • Opcode Fuzzy Hash: dc0349f3359b55ac83e25c3837a107be034ff85053e3974c30154b6231f7094c
                                    • Instruction Fuzzy Hash: 6C211631B18E428AEA00AB1BE8542792370FFF9BA4F5000B5DA4E67674DF3DE408C740
                                    Function 00007FF60F1A70FC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1691492610.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000002.00000002.1691469586.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691519836.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691591884.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                    • String ID: CONOUT$
                                    • API String ID: 3230265001-3130406586
                                    • Opcode ID: 2b1705eb60c5a9ea67d3abf5815f39d96026ea1e9a70ddd12955119ba33cdf2b
                                    • Instruction ID: 70de6ad0b09347a84b926f752badb5f0623c1975da3e785d8671f8dd350fed92
                                    • Opcode Fuzzy Hash: 2b1705eb60c5a9ea67d3abf5815f39d96026ea1e9a70ddd12955119ba33cdf2b
                                    • Instruction Fuzzy Hash: 15114932A1CA42C6E7508B52B95432973E4FB88BE4F244274EA5EC7794DF7CD9188740
                                    Function 00007FFE13301A40 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 28COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: abort$terminate
                                    • String ID: MOC$RCC$csm
                                    • API String ID: 579254285-2671469338
                                    • Opcode ID: 9c7a60497b8c52de3189ad328f62a3a7d4098e3573e82cc593336359ea62de81
                                    • Instruction ID: f0dd9817570429e75c9c13b51d9ccbea00eaf6793e9c89572017417d27104fc8
                                    • Opcode Fuzzy Hash: 9c7a60497b8c52de3189ad328f62a3a7d4098e3573e82cc593336359ea62de81
                                    • Instruction Fuzzy Hash: 78F01239E18E06CEE6585B53D04523C32A4AFB8B36F4158B5C52C32371CF7C69448A56
                                    Function 00007FFE133028B0 Relevance: 9.1, APIs: 6, Instructions: 129COMMON
                                    Download Yara Rule
                                    APIs
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000066,?,00007FFE1330252A), ref: 00007FFE133028E6
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000066,?,00007FFE1330252A), ref: 00007FFE13302919
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000066,?,00007FFE1330252A), ref: 00007FFE13302958
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000066,?,00007FFE1330252A), ref: 00007FFE13302979
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000066,?,00007FFE1330252A), ref: 00007FFE1330299C
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000066,?,00007FFE1330252A), ref: 00007FFE133029BA
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: abort
                                    • String ID:
                                    • API String ID: 4206212132-0
                                    • Opcode ID: e4ab483f4ef964f3aee83e99fc27c46ba6218ad878813aa3894a822b79d211fd
                                    • Instruction ID: 968ae335f8b9ec379a2108405be2ac36a32b4c2e65abba01edb69f0a70fc8b62
                                    • Opcode Fuzzy Hash: e4ab483f4ef964f3aee83e99fc27c46ba6218ad878813aa3894a822b79d211fd
                                    • Instruction Fuzzy Hash: D2516321E09F8689EB699B5A815037C2790AF74B64F0944B5CF6D727F5DF2CE825C308
                                    Function 00007FFE13277164 Relevance: 9.1, APIs: 6, Instructions: 59networkCOMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692291900.00007FFE13271000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFE13270000, based on PE: true
                                    • Associated: 00000002.00000002.1692276597.00007FFE13270000.00000002.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13281000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13283000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13286000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692354101.00007FFE13287000.00000080.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692369518.00007FFE13288000.00000004.00000001.01000000.00000007.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13270000_run0796.jbxd
                                    Similarity
                                    • API ID: Socketclosesocket$CurrentDuplicateHandleInformationProcess
                                    • String ID:
                                    • API String ID: 174288908-0
                                    • Opcode ID: 7138de7cf666f99256a31e383e740153c07012349ca9b434e65bdb1dca4ef917
                                    • Instruction ID: 6920d4110703c6366e21ad025c92de7665f4673b38e2e342cbe646ddbcfa810b
                                    • Opcode Fuzzy Hash: 7138de7cf666f99256a31e383e740153c07012349ca9b434e65bdb1dca4ef917
                                    • Instruction Fuzzy Hash: B5213320B19F4289EA647B26A81837923A0BFF4BB4F040675D82E567F4EE3CE405C600
                                    Function 00007FFE01397AD0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 298libraryloaderCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: ErrorLast$AddressProcValue
                                    • String ID: FlsGetValue
                                    • API String ID: 3663398396-662576866
                                    • Opcode ID: e4e2c4a3587466353b3ac0c7ecf3fb8968e7bc6575260a077602a664fb9ff940
                                    • Instruction ID: d30b24eee17f387e1eb689a444e32c7006fbdca2292190a2c14f5bf845e4d85e
                                    • Opcode Fuzzy Hash: e4e2c4a3587466353b3ac0c7ecf3fb8968e7bc6575260a077602a664fb9ff940
                                    • Instruction Fuzzy Hash: B4B1F261B2DA8282FF649B26A9042BA7391AF44FD4F494531CD4E1FBF9DE3CE4418A04
                                    Function 00007FFE148E26F8 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 200networkCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692491940.00007FFE148E1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00007FFE148E0000, based on PE: true
                                    • Associated: 00000002.00000002.1692469000.00007FFE148E0000.00000002.00000001.01000000.00000008.sdmpDownload File
                                    • Associated: 00000002.00000002.1692491940.00007FFE148E9000.00000040.00000001.01000000.00000008.sdmpDownload File
                                    • Associated: 00000002.00000002.1692543814.00007FFE148EA000.00000080.00000001.01000000.00000008.sdmpDownload File
                                    • Associated: 00000002.00000002.1692562185.00007FFE148EC000.00000004.00000001.01000000.00000008.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe148e0000_run0796.jbxd
                                    Similarity
                                    • API ID: select$00007A4480ErrorLast
                                    • String ID: timeout must be a float or None$timeout must be non-negative
                                    • API String ID: 2628283105-2150404077
                                    • Opcode ID: 99788f7e8e2d398d85ae76ba03251bf1ec8ee263d0e9fc0492a963463265e440
                                    • Instruction ID: 7658aad8c76bcace59346eed0fcf9cde222533a39cd92edb9b7d17b4762e4774
                                    • Opcode Fuzzy Hash: 99788f7e8e2d398d85ae76ba03251bf1ec8ee263d0e9fc0492a963463265e440
                                    • Instruction Fuzzy Hash: 46913431A08E8399EA219F26EC845B9A360FF46BA4F405175FA0D667B8DF3DD94DC700
                                    Function 00007FFE013ACD30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 167COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: _set_statfp
                                    • String ID: "$cosh
                                    • API String ID: 1156100317-3800341493
                                    • Opcode ID: a61dca7f21404ff4a322655326c6205bac334bf09e04c26996710cdf75f9daf9
                                    • Instruction ID: c38e16b1c4a17565beb1e1ba57a59b55e1d8fcfd621e1d71e43880a00223e1db
                                    • Opcode Fuzzy Hash: a61dca7f21404ff4a322655326c6205bac334bf09e04c26996710cdf75f9daf9
                                    • Instruction Fuzzy Hash: 66816331E28F8589D7638B34A4513B67369EF6A3D5F519333E58E39A71DF2CA1838600
                                    Function 00007FFE0138CA40 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 150libraryloaderCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: ErrorLast$AddressProcValue
                                    • String ID: FlsGetValue
                                    • API String ID: 3663398396-662576866
                                    • Opcode ID: 5b2a71626349c6b70572ce110cfdab6c0d8cc8c81acfd89e7d87e2c3e480110e
                                    • Instruction ID: fedf732ced3428dca87d224243aadd8db9aaced1027e3aa0f6e60320e12ca69f
                                    • Opcode Fuzzy Hash: 5b2a71626349c6b70572ce110cfdab6c0d8cc8c81acfd89e7d87e2c3e480110e
                                    • Instruction Fuzzy Hash: 3A51D021F0CB5282FB559B25A9002B9A3A0AF48BE4F495635ED5D5F7F4EE3CE8458300
                                    Function 00007FFE013AD1D0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 128COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: _set_statfp
                                    • String ID: "$coshf
                                    • API String ID: 1156100317-3152456168
                                    • Opcode ID: 2cbd73d72d1f212f0e840ead1081993e713157aeb2b29627e0262b9120ec3630
                                    • Instruction ID: cd4984cf16f067e62bd8c8f5c204424fe85ee6266418b494a280d9010e02728c
                                    • Opcode Fuzzy Hash: 2cbd73d72d1f212f0e840ead1081993e713157aeb2b29627e0262b9120ec3630
                                    • Instruction Fuzzy Hash: 4C51A131C2CF458AEB639B31A451265A76AEF567D0F518332E54E3AA75EF2CF0C28600
                                    Function 00007FFE013BA7C0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 125COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: Decorator::getName$DataName::Name::doName::operator+Name::operator+=Name::operator=PcharTemplateType
                                    • String ID: CV:
                                    • API String ID: 4239920947-3725821052
                                    • Opcode ID: b67cc8e34b0b0c8e487b6fb24c22fd5d7a6ed5cd9cebb98c98375a7178b170ab
                                    • Instruction ID: b963aa6610f1dc6861d296812e75a4bd3d636024a57feb4c3dda8f721ca4b689
                                    • Opcode Fuzzy Hash: b67cc8e34b0b0c8e487b6fb24c22fd5d7a6ed5cd9cebb98c98375a7178b170ab
                                    • Instruction Fuzzy Hash: 53518366E0CA4789FB518B25D8902B83BB1AF45B98F554035CA5E4FBF4EF7DA841D300
                                    Function 00007FFE0138D980 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84libraryloaderCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,00007FFE0138D961), ref: 00007FFE0138D9A6
                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,?,00007FFE0138D961), ref: 00007FFE0138D9ED
                                      • Part of subcall function 00007FFE0138DB30: EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FFE0138DA20,?,?,?,?,?,?,00007FFE0138D961), ref: 00007FFE0138DB5C
                                      • Part of subcall function 00007FFE0138DB30: LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00000000,00007FFE0138DA20,?,?,?,?,?,?,00007FFE0138D961), ref: 00007FFE0138DB78
                                    • TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,?,?,?,00007FFE0138D961), ref: 00007FFE013CA599
                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,?,?,?,00007FFE0138D961), ref: 00007FFE013CA5AF
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: CriticalErrorLastSection$AddressEnterLeaveProcValue
                                    • String ID: FlsGetValue
                                    • API String ID: 2861905401-662576866
                                    • Opcode ID: f072d435864527a4893847b6c262340e0ee2098a041a37e02d37a97d201ce830
                                    • Instruction ID: f13a61317bdcf4b7fa7dc8f74b8709e423aebd580a05c86cb8b55d366c7a48d6
                                    • Opcode Fuzzy Hash: f072d435864527a4893847b6c262340e0ee2098a041a37e02d37a97d201ce830
                                    • Instruction Fuzzy Hash: 37316261B09B0286FB149B68E85017973A1AF883A4F558236E96D4B7F4EF3CE845C700
                                    Function 00007FFE132750A8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83networkCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692291900.00007FFE13271000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFE13270000, based on PE: true
                                    • Associated: 00000002.00000002.1692276597.00007FFE13270000.00000002.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13281000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13283000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13286000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692354101.00007FFE13287000.00000080.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692369518.00007FFE13288000.00000004.00000001.01000000.00000007.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13270000_run0796.jbxd
                                    Similarity
                                    • API ID: ErrorLast$connect
                                    • String ID: 3'
                                    • API String ID: 375857812-280543908
                                    • Opcode ID: 9d0792441fc5044678e91fe98d31e73feb8c4f451fbd58069c187c194a03edea
                                    • Instruction ID: 63fd1bc27d7ee6e48ebec25e23c8ca1e2bb7c1a6f49a1f24241510bba325f7b7
                                    • Opcode Fuzzy Hash: 9d0792441fc5044678e91fe98d31e73feb8c4f451fbd58069c187c194a03edea
                                    • Instruction Fuzzy Hash: A9314331B08F82CAFB50AF27A854579A291BFF4BB5F240175E94EA27B4DE3CE441C640
                                    Function 00007FFE13302E92 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: abort$ExceptionRaise
                                    • String ID: csm
                                    • API String ID: 3453572468-1018135373
                                    • Opcode ID: a0f470496b3338efbe37c9d345d780ede6fcb3b70bc9e3d0c544a15374437034
                                    • Instruction ID: 964d900278fdde25913eed65855eb493113fb48ca38ebac81b612f2420fed5f8
                                    • Opcode Fuzzy Hash: a0f470496b3338efbe37c9d345d780ede6fcb3b70bc9e3d0c544a15374437034
                                    • Instruction Fuzzy Hash: 20316436608A418AE7249F12D44026D7760FBA8BB4F140271DE6D637B5CF3CE441C705
                                    Function 00007FFE1327765C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 73COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692291900.00007FFE13271000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFE13270000, based on PE: true
                                    • Associated: 00000002.00000002.1692276597.00007FFE13270000.00000002.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13281000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13283000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13286000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692354101.00007FFE13287000.00000080.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692369518.00007FFE13288000.00000004.00000001.01000000.00000007.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13270000_run0796.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: et:gethostbyaddr$idna$socket.gethostbyaddr$unsupported address family
                                    • API String ID: 0-1751716127
                                    • Opcode ID: 974771ad23af20d920d272cf528bd418683bbb1b06c52bc06fd23ce16be65df9
                                    • Instruction ID: 9b7cf22e5ffa1909f7e94700cebdd909b494ef3a0634c327916971053eda49c6
                                    • Opcode Fuzzy Hash: 974771ad23af20d920d272cf528bd418683bbb1b06c52bc06fd23ce16be65df9
                                    • Instruction Fuzzy Hash: 05311E22B08E8689EB60AB1BE8543BA6360FBF5BD4F444072DA4E67664DE3CE504C740
                                    Function 00007FFE01387250 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70libraryloaderCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFE01387232,?,?,?,00007FFE01383D4A,?,?,?,?,?,00007FFE01381395), ref: 00007FFE01387264
                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFE01387232,?,?,?,00007FFE01383D4A,?,?,?,?,?,00007FFE01381395), ref: 00007FFE013872A7
                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFE01387232,?,?,?,00007FFE01383D4A,?,?,?,?,?,00007FFE01381395), ref: 00007FFE013872F1
                                    • TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00007FFE01387232,?,?,?,00007FFE01383D4A,?,?,?,?,?,00007FFE01381395), ref: 00007FFE013C80E7
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: ErrorLast$AddressProcValue
                                    • String ID: FlsGetValue
                                    • API String ID: 3663398396-662576866
                                    • Opcode ID: 8c4cfa7bd90da7381d7e2cad420cf7ae98564061bc231c65ce60d6c65de917a8
                                    • Instruction ID: e9bd7715c97e6c3559eb5183fcbd431ec983b98ac956b23178d581052c2a6cc5
                                    • Opcode Fuzzy Hash: 8c4cfa7bd90da7381d7e2cad420cf7ae98564061bc231c65ce60d6c65de917a8
                                    • Instruction Fuzzy Hash: BE217F61F19B0286FF049B29E95017963A2AF487E4F598735E92D4F7F8EE3CE8458301
                                    Function 00007FFE01398DD0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69libraryloaderCOMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFE013CA666,?,?,00000000,00007FFE013CD82A,?,?,?,00007FFE013C7AE1), ref: 00007FFE01398DE4
                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFE013CA666,?,?,00000000,00007FFE013CD82A,?,?,?,00007FFE013C7AE1), ref: 00007FFE01398E2B
                                    • TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00007FFE013CA666,?,?,00000000,00007FFE013CD82A,?,?,?,00007FFE013C7AE1), ref: 00007FFE013C612F
                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFE013CA666,?,?,00000000,00007FFE013CD82A,?,?,?,00007FFE013C7AE1), ref: 00007FFE013C6145
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: ErrorLast$AddressProcValue
                                    • String ID: FlsGetValue
                                    • API String ID: 3663398396-662576866
                                    • Opcode ID: ce4f6164693054ca30ee57a630227fe5c0f775dd423d8a7d6c6f1b647305ae80
                                    • Instruction ID: 831654214dea6a3d2707dec0e343c95a362fc535064c29a594a24265f1a681c1
                                    • Opcode Fuzzy Hash: ce4f6164693054ca30ee57a630227fe5c0f775dd423d8a7d6c6f1b647305ae80
                                    • Instruction Fuzzy Hash: 27214DA1F19B0286FB049B25E95017963A2AF887A4F594335D92E5F7F4EE3CE8458301
                                    Function 00007FFE13275428 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 66COMMON
                                    Download Yara Rule
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692291900.00007FFE13271000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFE13270000, based on PE: true
                                    • Associated: 00000002.00000002.1692276597.00007FFE13270000.00000002.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13281000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13283000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13286000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692354101.00007FFE13287000.00000080.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692369518.00007FFE13288000.00000004.00000001.01000000.00000007.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13270000_run0796.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: OiII$iy#
                                    • API String ID: 0-3267959945
                                    • Opcode ID: 6ecd11499d5d71d6cb424291d44840528deedcdec41fed1fd353bc168884c5bb
                                    • Instruction ID: d87e3bd8bdbbaf329f0aaaee40dde1606353a181db2b17af0ed98674502bc002
                                    • Opcode Fuzzy Hash: 6ecd11499d5d71d6cb424291d44840528deedcdec41fed1fd353bc168884c5bb
                                    • Instruction Fuzzy Hash: 36212161B08E92CAEA246F27A554079A361BFF8BE1B5440B5CA4D67BB1EF2CE451C700
                                    Function 00007FFE13304830 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 51memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: AllocFree
                                    • String ID: FlsAlloc$FlsFree$__based(
                                    • API String ID: 265982327-1814498500
                                    • Opcode ID: 54e4ea7337ee46c35fd7b6825b034efbdce11ec9159bc44db4f3c68ed160b025
                                    • Instruction ID: de4dd3b76b0432ee29592d5337d13f8cc6831327d5482d679b18f7cc72321cd3
                                    • Opcode Fuzzy Hash: 54e4ea7337ee46c35fd7b6825b034efbdce11ec9159bc44db4f3c68ed160b025
                                    • Instruction Fuzzy Hash: 76114D20E0DE4799FA549B23A8850BC2391AF34775B4009B5D57E362F1DF3CE6058B1C
                                    Function 00007FFE13277C80 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 44networkCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692291900.00007FFE13271000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFE13270000, based on PE: true
                                    • Associated: 00000002.00000002.1692276597.00007FFE13270000.00000002.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13281000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13283000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13286000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692354101.00007FFE13287000.00000080.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692369518.00007FFE13288000.00000004.00000001.01000000.00000007.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13270000_run0796.jbxd
                                    Similarity
                                    • API ID: getservbynamehtons
                                    • String ID: service/proto not found$socket.getservbyname$s|s:getservbyname
                                    • API String ID: 3889749166-1257235949
                                    • Opcode ID: 4fcc85b13632f52815bd33602d30490cef968fee825d94501babe309e3752164
                                    • Instruction ID: 2d21091dbc0bb257bd58a1a591e8f5bab637e0a40f9cad1b668d9171e7382787
                                    • Opcode Fuzzy Hash: 4fcc85b13632f52815bd33602d30490cef968fee825d94501babe309e3752164
                                    • Instruction Fuzzy Hash: F811FC71A08E4289EA04AB27E8542796370FBF5BA5F501075DA8D67674DF3CE445C700
                                    Function 00007FFE013C3644 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 38fileCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                    • String ID: CONOUT$
                                    • API String ID: 3230265001-3130406586
                                    • Opcode ID: c04be7df5962b4ca2a526bf3f45f432c3903d0931af474cd28b0175bc7d5c165
                                    • Instruction ID: 86bbf4d307ef8c2436c2a523ee89d2f88ab9a8731d2055b06fe6a8cca96cb020
                                    • Opcode Fuzzy Hash: c04be7df5962b4ca2a526bf3f45f432c3903d0931af474cd28b0175bc7d5c165
                                    • Instruction Fuzzy Hash: 7D116972A18A4287EB508F56E4443A973B0FB88BD8F144135DA8D4B778CF3CD865CB01
                                    Function 00007FFE13275528 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38networkCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692291900.00007FFE13271000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFE13270000, based on PE: true
                                    • Associated: 00000002.00000002.1692276597.00007FFE13270000.00000002.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13281000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13283000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13286000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692354101.00007FFE13287000.00000080.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692369518.00007FFE13288000.00000004.00000001.01000000.00000007.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13270000_run0796.jbxd
                                    Similarity
                                    • API ID: 00007Startup
                                    • String ID: WSAStartup failed: error code %d$WSAStartup failed: network not ready$WSAStartup failed: requested version not supported
                                    • API String ID: 939726317-2179513580
                                    • Opcode ID: 10e81ce022be9c6644ba46257e410a3f9e6120ba4fc22d17ee6881ad74e80977
                                    • Instruction ID: 549c4cbe5c523e520eee7412167d2be9a954b2d8efd853ea2186a3aeb4662bba
                                    • Opcode Fuzzy Hash: 10e81ce022be9c6644ba46257e410a3f9e6120ba4fc22d17ee6881ad74e80977
                                    • Instruction Fuzzy Hash: 7F11F175B08E82CDF660A716D8652B463A1FBF97A5F5040B1D40D66674DE6DE448C300
                                    Function 00007FFE013856E4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: AddressFreeHandleLibraryModuleProc
                                    • String ID: CorExitProcess$mscoree.dll
                                    • API String ID: 4061214504-1276376045
                                    • Opcode ID: 38f1c9a3e5da8ec76cca111081b417a6c2648a2653dbba2a19f639492ce0a011
                                    • Instruction ID: 78377c0010b752baac92341c7210f9ddea2c50e70f4ae1e24581ad0da6496722
                                    • Opcode Fuzzy Hash: 38f1c9a3e5da8ec76cca111081b417a6c2648a2653dbba2a19f639492ce0a011
                                    • Instruction Fuzzy Hash: 86F0DA61B2E642C2FF585B10E89437D2364AF98791F455435E94F4E5B4DF2CE5888700
                                    Function 00007FFE0138A880 Relevance: 7.8, APIs: 5, Instructions: 303COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 2c5363838be8a4ec3bfbd5de901e861b574f4757e8892c8627142229e74fca17
                                    • Instruction ID: 5ea61543ee740b227efe834722116617dbbea30f2813ff395189a93212520674
                                    • Opcode Fuzzy Hash: 2c5363838be8a4ec3bfbd5de901e861b574f4757e8892c8627142229e74fca17
                                    • Instruction Fuzzy Hash: 41D1AF32B0C7828AFB619B6491402BD76B1EF54BE8F064232DE9D5BBE5DE3CD5418310
                                    Function 00007FFE13309C84 Relevance: 7.6, APIs: 5, Instructions: 143COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: Name::operator+$NameName::
                                    • String ID:
                                    • API String ID: 168861036-0
                                    • Opcode ID: 05f6c9b8cef8aaff6f7b8e4e38ae0c77bd3df8e4f84dc53290f47b7289bc6966
                                    • Instruction ID: 4298a15eecdf8ed58300a99d46a2a30e2726fd8c4528d18237fca876f38e45d0
                                    • Opcode Fuzzy Hash: 05f6c9b8cef8aaff6f7b8e4e38ae0c77bd3df8e4f84dc53290f47b7289bc6966
                                    • Instruction Fuzzy Hash: 6F614B72A08E558CE711CF26E8805AD3775FB68B94F9480B5EA6D63B76DF38D841C304
                                    Function 00007FFE13277F9C Relevance: 7.6, APIs: 5, Instructions: 98COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692291900.00007FFE13271000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFE13270000, based on PE: true
                                    • Associated: 00000002.00000002.1692276597.00007FFE13270000.00000002.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13281000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13283000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13286000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692354101.00007FFE13287000.00000080.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692369518.00007FFE13288000.00000004.00000001.01000000.00000007.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13270000_run0796.jbxd
                                    Similarity
                                    • API ID: FreeTable$ConvertInterfaceLuidNameTable2
                                    • String ID:
                                    • API String ID: 1671601251-0
                                    • Opcode ID: 7b6afd35a454c464795ed6a9c2513b32d1fd9e66ea611b4ee14a2fd8ce1d6cda
                                    • Instruction ID: a00e81bb562c2954c3ff9027b5c45714e4f7ee0ba51388a7ab3749b26249fec8
                                    • Opcode Fuzzy Hash: 7b6afd35a454c464795ed6a9c2513b32d1fd9e66ea611b4ee14a2fd8ce1d6cda
                                    • Instruction Fuzzy Hash: F7413031F1CF4289EA64AB23A81527963A0FFF5BA5F040071D94EA76B4DF2CE405CB41
                                    Function 00007FFE13303340 Relevance: 7.6, APIs: 5, Instructions: 83COMMON
                                    Download Yara Rule
                                    APIs
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FFE133024AF), ref: 00007FFE13303452
                                      • Part of subcall function 00007FFE133048F4: GetLastError.KERNEL32(?,?,?,00007FFE13301831), ref: 00007FFE13304918
                                      • Part of subcall function 00007FFE133048F4: SetLastError.KERNEL32(?,?,?,00007FFE13301831), ref: 00007FFE133049C0
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FFE133024AF), ref: 00007FFE1330343D
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FFE133024AF), ref: 00007FFE13303444
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FFE133024AF), ref: 00007FFE1330344B
                                    • terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FFE133024AF), ref: 00007FFE13303459
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: abort$ErrorLast$terminate
                                    • String ID:
                                    • API String ID: 3823219622-0
                                    • Opcode ID: 20405dfbf244a3566e5a1d9f09ca0e0238db28aba3bd7d0cc38adc7fa1fba175
                                    • Instruction ID: 430c1a05858e75aa558db39fe470bf53efdef4d47469be6c4ec120fc97d090d2
                                    • Opcode Fuzzy Hash: 20405dfbf244a3566e5a1d9f09ca0e0238db28aba3bd7d0cc38adc7fa1fba175
                                    • Instruction Fuzzy Hash: 84319032A08F82C9EA15DB57D4801BE6764FF64FB5B0548B2DE2D27761DE38E481C344
                                    Function 00007FFE013BF030 Relevance: 7.6, APIs: 5, Instructions: 71COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: Name::operator+$Decorator::getName::operator+=$FrameLexicalNameName::Name::doPcharScope
                                    • String ID:
                                    • API String ID: 1546031984-0
                                    • Opcode ID: a41a32a73ef280f1c0eb226252b6108ad4bbb78884f5fa41fe49f468b2489355
                                    • Instruction ID: bddfcdd28fdf4e1bb13fb0b3773c349b69281a14adcaec312eb66d97f01f2f4f
                                    • Opcode Fuzzy Hash: a41a32a73ef280f1c0eb226252b6108ad4bbb78884f5fa41fe49f468b2489355
                                    • Instruction Fuzzy Hash: A3318E73908B869AEB118F24D8803A977A5EB85B88F59D035D78D0B3B6EF7CD444C710
                                    Function 00007FFE013ADFCC Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: _set_statfp
                                    • String ID:
                                    • API String ID: 1156100317-0
                                    • Opcode ID: dc6e3670485b0d4430f46cbfa2b7112dabbfdd72c5e42d9f16c55895acb062e8
                                    • Instruction ID: e9304f8ec7ccd1beb4f353171cff710b347f09888762ad4b0d3bd934f6527273
                                    • Opcode Fuzzy Hash: dc6e3670485b0d4430f46cbfa2b7112dabbfdd72c5e42d9f16c55895acb062e8
                                    • Instruction Fuzzy Hash: 0011E562E9CA0309F764652AE48637A1141AF58370FCB4B34EA7E4E6FB9F7CA8414214
                                    Function 00007FF60F19A864 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                    Download Yara Rule
                                    APIs
                                    • FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF60F1A24C3,?,?,?,00007FF60F19CCFC,?,?,00000000,00007FF60F19387F), ref: 00007FF60F19A875
                                    • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF60F1A24C3,?,?,?,00007FF60F19CCFC,?,?,00000000,00007FF60F19387F), ref: 00007FF60F19A894
                                    • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF60F1A24C3,?,?,?,00007FF60F19CCFC,?,?,00000000,00007FF60F19387F), ref: 00007FF60F19A8BC
                                    • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF60F1A24C3,?,?,?,00007FF60F19CCFC,?,?,00000000,00007FF60F19387F), ref: 00007FF60F19A8CD
                                    • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF60F1A24C3,?,?,?,00007FF60F19CCFC,?,?,00000000,00007FF60F19387F), ref: 00007FF60F19A8DE
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1691492610.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000002.00000002.1691469586.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691519836.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691591884.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: Value
                                    • String ID:
                                    • API String ID: 3702945584-0
                                    • Opcode ID: c0fb399be8661876b698731ebb01a083231cf0cb32d6881bef92b5c8a6d37d35
                                    • Instruction ID: 0549284f06115540e54ee3fd8268cdb9c02f8090884a346f19b327c080e87c8e
                                    • Opcode Fuzzy Hash: c0fb399be8661876b698731ebb01a083231cf0cb32d6881bef92b5c8a6d37d35
                                    • Instruction Fuzzy Hash: 11110C34E0D20741FA6CA37664521796742CF863B0F785BB8E93ECA2C2DF2CB4464791
                                    Function 00007FFE13301930 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 44COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: ErrorLast$Value
                                    • String ID: FlsGetValue$__based(
                                    • API String ID: 1883355122-1499225077
                                    • Opcode ID: 3cde031b42971c501b99c4d062fe830ef97904619396822104c6fd8221abb387
                                    • Instruction ID: 10788246275fcf36316d33a8862bcb9e04099118bd42da41dcbf0ea588c79d94
                                    • Opcode Fuzzy Hash: 3cde031b42971c501b99c4d062fe830ef97904619396822104c6fd8221abb387
                                    • Instruction Fuzzy Hash: B4119421B08E468AEA549F27A94017D33A0AB247B0B440775E5BE273F5DF3CE4408798
                                    Function 00007FFE1330C1D0 Relevance: 7.5, APIs: 5, Instructions: 41COMMON
                                    Download Yara Rule
                                    APIs
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,00007FFE13302F17), ref: 00007FFE1330C1E7
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,00007FFE13302F17), ref: 00007FFE1330C1FE
                                    • terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,00007FFE13302F17), ref: 00007FFE1330C219
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,00007FFE13302F17), ref: 00007FFE1330C22D
                                    • terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,00007FFE13302F17), ref: 00007FFE1330C247
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: abort$terminate
                                    • String ID:
                                    • API String ID: 579254285-0
                                    • Opcode ID: b9a64d3d6ee68471bce02abac799c6deb2a21801f345f0dcf847466b3a3e6a69
                                    • Instruction ID: 3a64eb0c0f7f09111fdadcb631ad7eab5f8478f68f3f35052e7d833c83f9106f
                                    • Opcode Fuzzy Hash: b9a64d3d6ee68471bce02abac799c6deb2a21801f345f0dcf847466b3a3e6a69
                                    • Instruction Fuzzy Hash: 02012531A0DF8699FE189B97E08413D5364AF78B74F1808B5DA3C26B75DE2CE4508219
                                    Function 00007FFE13301890 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: ErrorLast$Value
                                    • String ID: FlsGetValue$__based(
                                    • API String ID: 1883355122-1499225077
                                    • Opcode ID: 1694fcc8876eaf970d65f9f7cf6b22be3eb451f9a49f8659623d94e435215b4e
                                    • Instruction ID: d858c57ae58f3e03739a30112c334bcd0457a69175406cd55eb2109e78e72b2c
                                    • Opcode Fuzzy Hash: 1694fcc8876eaf970d65f9f7cf6b22be3eb451f9a49f8659623d94e435215b4e
                                    • Instruction Fuzzy Hash: 6E11AC24F09F428AEA449B16A98407C7362FB687B0B440275EA7E237F5DF3CE9418758
                                    Function 00007FFE013AE6A0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 177COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: _set_statfp
                                    • String ID: "$sinh
                                    • API String ID: 1156100317-1232919748
                                    • Opcode ID: 1b32543455a6c8168f2937d647417d3a52b2d3b296e9a1f1c63220f0cefa6fe5
                                    • Instruction ID: 3363052220d1f2e478c2ecec3443f7e471158ecf684228cd3b07e80fcf3998fb
                                    • Opcode Fuzzy Hash: 1b32543455a6c8168f2937d647417d3a52b2d3b296e9a1f1c63220f0cefa6fe5
                                    • Instruction Fuzzy Hash: A8918121E28F8189E7638B34A4513B67759EF6A3D5F519337E58E39A71DF2CA0838700
                                    Function 00007FFE13274AF0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 169networkCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692291900.00007FFE13271000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFE13270000, based on PE: true
                                    • Associated: 00000002.00000002.1692276597.00007FFE13270000.00000002.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13281000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13283000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13286000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692354101.00007FFE13287000.00000080.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692369518.00007FFE13288000.00000004.00000001.01000000.00000007.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13270000_run0796.jbxd
                                    Similarity
                                    • API ID: 00007A3440ErrorLast
                                    • String ID: NOO$unsupported address family
                                    • API String ID: 848807496-3515961143
                                    • Opcode ID: 909fc28e825e186d18d6ade4b90d007801ae108912a46624615076baaa721aae
                                    • Instruction ID: e0965d2b26d03f378cb2d03211d5bbd51c06167f811e019aa1b94d70069db900
                                    • Opcode Fuzzy Hash: 909fc28e825e186d18d6ade4b90d007801ae108912a46624615076baaa721aae
                                    • Instruction Fuzzy Hash: 5A716D31A09F8289EA54AF26A45457A63A0FFF4BA4F0541B5DE8E27774EF3CE440C700
                                    Function 00007FFE013ACBA3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: _set_statfp
                                    • String ID: "$_hypot
                                    • API String ID: 1156100317-1188193384
                                    • Opcode ID: 30edd1d860c6fbca9ed95a4b2fcb81cbc6a271cc11a0906b11b1b7d0d48f6558
                                    • Instruction ID: 1e589bc699580e0683b563c62fe3c11c2dec5781fb6e9db300c118b610f418e9
                                    • Opcode Fuzzy Hash: 30edd1d860c6fbca9ed95a4b2fcb81cbc6a271cc11a0906b11b1b7d0d48f6558
                                    • Instruction Fuzzy Hash: 6F51B87291DF8986EB12CF61A40037AB265FF96780F914331FA5E2AEA5DF3CE141C640
                                    Function 00007FFE013AB496 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: _set_statfp
                                    • String ID: !$acosf
                                    • API String ID: 1156100317-101895715
                                    • Opcode ID: 71ec19b4c8ad8ee9648a7ba0fa85dfd1995abbbd0122232bfbe41f41b9ffeac9
                                    • Instruction ID: 5dbf97e298d5679772b5c1c366a8a84b668da5e2e908f05cf9e23092646f6dea
                                    • Opcode Fuzzy Hash: 71ec19b4c8ad8ee9648a7ba0fa85dfd1995abbbd0122232bfbe41f41b9ffeac9
                                    • Instruction Fuzzy Hash: F351D831C2CA8986E322C73B5841175E650FFAA340F69C736ED59799B4DF3DB0859E00
                                    Function 00007FFE013AEB80 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 131COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: _set_statfp
                                    • String ID: "$sinhf
                                    • API String ID: 1156100317-3935523221
                                    • Opcode ID: 918958a1fb63c09ba493611ac2a7382131e3e9afba7afa72afa230d2478bc51d
                                    • Instruction ID: ab57cda95afa00d89ebad4a003584eb7c64fc4eea24022ef8cc7557ac627e1ad
                                    • Opcode Fuzzy Hash: 918958a1fb63c09ba493611ac2a7382131e3e9afba7afa72afa230d2478bc51d
                                    • Instruction Fuzzy Hash: 8D61A231D1CF818AEB639B35A451275A355FF563D1F618332E58E3AA75EF3CA0C28600
                                    Function 00007FFE013AB9B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 117COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: _set_statfp
                                    • String ID: !$asinf
                                    • API String ID: 1156100317-2917828882
                                    • Opcode ID: e02c587f2bbad5ae47ffa9e0c77fe692eca3b15f8905fe1beaed0f650771b692
                                    • Instruction ID: 441792e5f4aa00f7723671d44efc971da7d2b5748573cbf8c58b7174bf79279f
                                    • Opcode Fuzzy Hash: e02c587f2bbad5ae47ffa9e0c77fe692eca3b15f8905fe1beaed0f650771b692
                                    • Instruction Fuzzy Hash: F9516331D2DA8986F322C73B648127AB650BFAE341F69CB25ED48699F4DF3D70459A00
                                    Function 00007FFE013E9288 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91libraryloaderCOMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,?,?,?,?,00000000,00000000,00007FFE013EAD0E), ref: 00007FFE013E9303
                                    • CompareStringW.API-MS-WIN-CORE-STRING-L1-1-0(?,?,?,?,?,?,?,00000000,00000000,00007FFE013EAD0E), ref: 00007FFE013E935F
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: AddressCompareProcString
                                    • String ID: AreFileApisANSI$CompareStringEx
                                    • API String ID: 108076903-3979650549
                                    • Opcode ID: 9c01116c69461785fb70ad1c05279c168e2a8828430552149869a588c4d73f25
                                    • Instruction ID: 8c72051dd547b92ab1edce2fa9d1faa784281205d038cd93427bafed2b0fbd81
                                    • Opcode Fuzzy Hash: 9c01116c69461785fb70ad1c05279c168e2a8828430552149869a588c4d73f25
                                    • Instruction Fuzzy Hash: 36319331B1CB4286EB54CB2AE84026973E0BB587A8F144335DD6D9B7F8DE3CE8018700
                                    Function 00007FFE01388010 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 90libraryloaderCOMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,?,?,?,00000000,00000098,00000000,00007FFE013EC258), ref: 00007FFE013880DA
                                    • LCMapStringW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,?,?,?,?,00000000,00000098,00000000,00007FFE013EC258), ref: 00007FFE013C842D
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: AddressProcString
                                    • String ID: LCIDToLocaleName$LCMapStringEx
                                    • API String ID: 3874510993-3928102921
                                    • Opcode ID: a0cdd02db15d2baaee71b25ddafbc6e81294e66017932d8cf8f93dd6d9f3de1a
                                    • Instruction ID: f1ab3376dd553c7cd447a5c6fde797c54eccaddfd80f7570cb866330ee4c74dc
                                    • Opcode Fuzzy Hash: a0cdd02db15d2baaee71b25ddafbc6e81294e66017932d8cf8f93dd6d9f3de1a
                                    • Instruction Fuzzy Hash: 66318071B1DB4286EB14CB19F85027A67A1BB88BA4F454339EE6D8B7B4DF3CE4418700
                                    Function 00007FFE013E95F4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 85libraryloaderCOMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,?,?,?,?,00007FFE01425634,?,?,?,?,?,?,00000000,?), ref: 00007FFE013E966F
                                    • GetDateFormatW.API-MS-WIN-CORE-DATETIME-L1-1-0(?,?,?,?,?,?,?,00007FFE01425634,?,?,?,?,?,?,00000000,?), ref: 00007FFE013E96C5
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: AddressDateFormatProc
                                    • String ID: GetDateFormatEx$GetLocaleInfoEx
                                    • API String ID: 2680382325-3651929019
                                    • Opcode ID: 7c3b1c42358e41c3879f7fc51d98f508681f88725dc7721055a332750a378f6d
                                    • Instruction ID: 0a5fa0023cb165c337764f009e3e9c57533946984fd7a780e6b65df12e601831
                                    • Opcode Fuzzy Hash: 7c3b1c42358e41c3879f7fc51d98f508681f88725dc7721055a332750a378f6d
                                    • Instruction Fuzzy Hash: 04311021B1DB4286EB14DB1AE81022A67A1BB547E8F454336EE5D4B7F8DF3CE505CB00
                                    Function 00007FFE013E981C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 84libraryloadertimeCOMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,?,?,?,?,00007FFE014256D7,?,?,?,?,?,?,00000000,?), ref: 00007FFE013E9897
                                    • GetTimeFormatW.API-MS-WIN-CORE-DATETIME-L1-1-0(?,?,?,?,?,?,?,00007FFE014256D7,?,?,?,?,?,?,00000000,?), ref: 00007FFE013E98ED
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: AddressFormatProcTime
                                    • String ID: GetLocaleInfoEx$GetTimeFormatEx
                                    • API String ID: 3572143191-1887218579
                                    • Opcode ID: c88a4ff822122563e7e13919ba5be6c966a78eb1ab820d30e35d194ba584dd40
                                    • Instruction ID: 11585ab4f8d077f8ff08e0423ce859cbfb12176e9e44a3f10ef846e168379149
                                    • Opcode Fuzzy Hash: c88a4ff822122563e7e13919ba5be6c966a78eb1ab820d30e35d194ba584dd40
                                    • Instruction Fuzzy Hash: 43314121B1DB4286EB14DB2AE81026967E1FB587E8F454336EE6D4B7F8DE3CE4058700
                                    Function 00007FFE01387390 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83libraryloaderCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFE013875A3,?,?,00000000,00007FFE01388AE1), ref: 00007FFE01387454
                                    • InitializeCriticalSectionAndSpinCount.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FFE013875A3,?,?,00000000,00007FFE01388AE1), ref: 00007FFE013C812D
                                    • __vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00007FFE013C813B
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: AddressCountCriticalInitializeProcSectionSpin__vcrt_uninitialize_locks
                                    • String ID: InitializeCriticalSectionEx
                                    • API String ID: 3597771952-3084827643
                                    • Opcode ID: 64c6903de641859419fbbc5e7920358b8a09ef9f9e97dbfbfc7f49064fec7532
                                    • Instruction ID: 5633748b378f3a3b6224896e26c9837a675a456ea7e18446f729a1b91ac08310
                                    • Opcode Fuzzy Hash: 64c6903de641859419fbbc5e7920358b8a09ef9f9e97dbfbfc7f49064fec7532
                                    • Instruction Fuzzy Hash: 2E31AF21B18B0382FB589B25E85017923A2EF857A8F555236DD2E5FBF8DF3CE4468340
                                    Function 00007FFE13272600 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692291900.00007FFE13271000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFE13270000, based on PE: true
                                    • Associated: 00000002.00000002.1692276597.00007FFE13270000.00000002.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13281000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13283000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13286000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692354101.00007FFE13287000.00000080.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692369518.00007FFE13288000.00000004.00000001.01000000.00000007.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13270000_run0796.jbxd
                                    Similarity
                                    • API ID: ComputerErrorLastName
                                    • String ID: socket.gethostname
                                    • API String ID: 3560734967-2650736202
                                    • Opcode ID: 095da23aa149d5187cd0f7ae323386cb0076a1ee99408e4307cb689096eda50e
                                    • Instruction ID: 97c13214a1274cc9137eab0a0e2ace7c3f2748e33aa12c2cb8ac5647cb23e8a7
                                    • Opcode Fuzzy Hash: 095da23aa149d5187cd0f7ae323386cb0076a1ee99408e4307cb689096eda50e
                                    • Instruction Fuzzy Hash: CD31F021B0CF428AE724AB23E81527A63A5FFF97A5F444175D94E666B4DF3CE405C700
                                    Function 00007FFE13275EF4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692291900.00007FFE13271000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFE13270000, based on PE: true
                                    • Associated: 00000002.00000002.1692276597.00007FFE13270000.00000002.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13281000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13283000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13286000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692354101.00007FFE13287000.00000080.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692369518.00007FFE13288000.00000004.00000001.01000000.00000007.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13270000_run0796.jbxd
                                    Similarity
                                    • API ID: getsockopt
                                    • String ID: getsockopt buflen out of range$ii|i:getsockopt
                                    • API String ID: 3272894102-2750947780
                                    • Opcode ID: 0322cdff57f77cc2b7393446e0397869c2c2d530b9d2fbdfc7ba9d1bd7ad0373
                                    • Instruction ID: df36c672fc93a74432660a8e0fbea9ca361a4be9a41e12e54bb7b77f2060bf75
                                    • Opcode Fuzzy Hash: 0322cdff57f77cc2b7393446e0397869c2c2d530b9d2fbdfc7ba9d1bd7ad0373
                                    • Instruction Fuzzy Hash: 96310972B18E42CBEB54AF26E45406A73A1FBE4B64B200175EA4E97A74DF3DD405CB00
                                    Function 00007FFE132782C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692291900.00007FFE13271000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFE13270000, based on PE: true
                                    • Associated: 00000002.00000002.1692276597.00007FFE13270000.00000002.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13281000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13283000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13286000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692354101.00007FFE13287000.00000080.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692369518.00007FFE13288000.00000004.00000001.01000000.00000007.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13270000_run0796.jbxd
                                    Similarity
                                    • API ID: inet_ntop
                                    • String ID: invalid length of packed IP address string$iy*:inet_ntop$unknown address family %d
                                    • API String ID: 448242623-2822559286
                                    • Opcode ID: 821bdc76849829ac382dd6bfe7ebbdf4799ccd67fbae3e73fb104eed7083eac5
                                    • Instruction ID: 9c42912d845d2eb0589ff7b2143d225c1d22381e17ceb1dc48cfbbc96b8c168a
                                    • Opcode Fuzzy Hash: 821bdc76849829ac382dd6bfe7ebbdf4799ccd67fbae3e73fb104eed7083eac5
                                    • Instruction Fuzzy Hash: D531FB31B18E4389EB60AB27E86467923B0FBF5B64F404472D54EA7674DE7CE449C700
                                    Function 00007FFE013ADE30 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 68COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: _handle_errorf_raise_excf_set_statfp
                                    • String ID: "$_hypotf
                                    • API String ID: 2298391848-905711854
                                    • Opcode ID: 5f43d922e01293972ed8460855153002ebb918f5f1b2f1ea9cc3e8d90e8f3529
                                    • Instruction ID: 9094bac4a6b6e1f216f2632924407e7de575dbf946027840a736c92bd7dd8538
                                    • Opcode Fuzzy Hash: 5f43d922e01293972ed8460855153002ebb918f5f1b2f1ea9cc3e8d90e8f3529
                                    • Instruction Fuzzy Hash: CF213A32D2DB8546D632CA3294016769656BFA7390F618332F97E39DE4CB3CE0859B00
                                    Function 00007FFE013E9A58 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65libraryloaderCOMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: AddressLocaleProcValid
                                    • String ID: IsValidLocaleName$LCIDToLocaleName
                                    • API String ID: 2003423906-1752364312
                                    • Opcode ID: 65b0c262ca36154cd53a740d3a81f65cf26c20ac48d112a99bb656f3d84eeda0
                                    • Instruction ID: 867be05c3674ff1c4c784cc4c7aba72b8677b9584041a25837bcafbdc6c32fd3
                                    • Opcode Fuzzy Hash: 65b0c262ca36154cd53a740d3a81f65cf26c20ac48d112a99bb656f3d84eeda0
                                    • Instruction Fuzzy Hash: AF215E60B1DB4342FF08876AE95027923A1AF587E8F555335DD2D5B7F4EE6CE4858300
                                    Function 00007FFE01381EC0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64libraryloaderCOMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,00000098,00007FFE01381E63), ref: 00007FFE01381F40
                                    • GetUserDefaultLCID.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(?,?,00000098,00007FFE01381E63), ref: 00007FFE013C682B
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: AddressDefaultProcUser
                                    • String ID: GetUserDefaultLocaleName$LCIDToLocaleName
                                    • API String ID: 306211784-2335043742
                                    • Opcode ID: 189e9eb15733c52c6acb18485faa6e2e3afa5949e2a93b7d527beaa8dac3b8c9
                                    • Instruction ID: 837a28b550c4ef8c4424cc086876bb7450767d5a4bba40f89b47e7193128a60c
                                    • Opcode Fuzzy Hash: 189e9eb15733c52c6acb18485faa6e2e3afa5949e2a93b7d527beaa8dac3b8c9
                                    • Instruction Fuzzy Hash: 86216DA1B1AB0342FF049B25E91017963A2AF487A8F555735DD2E1F7F8EE3CE4458300
                                    Function 00007FFE13301BA0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: terminate
                                    • String ID: csm
                                    • API String ID: 1821763600-1018135373
                                    • Opcode ID: 438b22e0981f78b69658ddcae18d3ec84825a9baaa088e9bbe4ec400c4afb42d
                                    • Instruction ID: 2b70a8b96b7002ccf25ccdd0c37bb5ffbeae4977a3b50d9b87ed4c5b350138f4
                                    • Opcode Fuzzy Hash: 438b22e0981f78b69658ddcae18d3ec84825a9baaa088e9bbe4ec400c4afb42d
                                    • Instruction Fuzzy Hash: 8911DABAE08E4A8AFB68CF66D08517C2762FF30761F544475C92D53760DE2CD491C205
                                    Function 00007FFE1327785C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 52networkCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692291900.00007FFE13271000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFE13270000, based on PE: true
                                    • Associated: 00000002.00000002.1692276597.00007FFE13270000.00000002.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13281000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13283000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13286000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692354101.00007FFE13287000.00000080.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692369518.00007FFE13288000.00000004.00000001.01000000.00000007.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13270000_run0796.jbxd
                                    Similarity
                                    • API ID: gethostbyname
                                    • String ID: et:gethostbyname_ex$idna$socket.gethostbyname
                                    • API String ID: 930432418-574663143
                                    • Opcode ID: 54f4fd81d729306ff9aedb914a1bb74dce5a6755a4873b6e6c034d5538e1bf51
                                    • Instruction ID: 706b7a9c8e4e29bfd2c1d3e9b9b376d8dcf406dc4351e48aa56b72498bb02a14
                                    • Opcode Fuzzy Hash: 54f4fd81d729306ff9aedb914a1bb74dce5a6755a4873b6e6c034d5538e1bf51
                                    • Instruction Fuzzy Hash: 6D21FC21B08E8689EB60AB27F9547BA63A0FFF9BA4F444075D94E67675DE2CE104C700
                                    Function 00007FFE13278404 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 47COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692291900.00007FFE13271000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFE13270000, based on PE: true
                                    • Associated: 00000002.00000002.1692276597.00007FFE13270000.00000002.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13281000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13283000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13286000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692354101.00007FFE13287000.00000080.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692369518.00007FFE13288000.00000004.00000001.01000000.00000007.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13270000_run0796.jbxd
                                    Similarity
                                    • API ID: inet_pton
                                    • String ID: illegal IP address string passed to inet_pton$is:inet_pton$unknown address family
                                    • API String ID: 1350483568-903159468
                                    • Opcode ID: 6b3a4026c44cec4ec7538d6aa5690018d334bb71108f633ead04177c9dedd22e
                                    • Instruction ID: c79ae1494d7a39b3d3322c1f5f72bb1df833be79aa7d202e6a5990e9926e024e
                                    • Opcode Fuzzy Hash: 6b3a4026c44cec4ec7538d6aa5690018d334bb71108f633ead04177c9dedd22e
                                    • Instruction Fuzzy Hash: CE213E72B18E4289EA60FB16E86107937B1FBF4B64F5040B2D64E66574DFBCE505C700
                                    Function 00007FFE013BF134 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: Name::doName::operator+Pchar
                                    • String ID: -$generic-type-
                                    • API String ID: 2230304450-2190548783
                                    • Opcode ID: a222bea0931922b931cd2f10f3fe1c7f4edeeeddb3b74bbb269479d4843b1b80
                                    • Instruction ID: e0e0509996ed860237be293bcdd3e3eddbfb43964030e94612797feebab1506d
                                    • Opcode Fuzzy Hash: a222bea0931922b931cd2f10f3fe1c7f4edeeeddb3b74bbb269479d4843b1b80
                                    • Instruction Fuzzy Hash: 8B010422A0C68195EB108B11E9803BAB320FB857D8F144031D79D0FBBAEF7CD0548700
                                    Function 00007FFE13277EA8 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 32networkCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    • i:htons, xrefs: 00007FFE13277EB4
                                    • htons: Python int too large to convert to C 16-bit unsigned integer (The silent truncation is deprecated), xrefs: 00007FFE13277EF9
                                    • htons: can't convert negative Python int to C 16-bit unsigned integer, xrefs: 00007FFE13277ED4
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692291900.00007FFE13271000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFE13270000, based on PE: true
                                    • Associated: 00000002.00000002.1692276597.00007FFE13270000.00000002.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13281000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13283000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13286000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692354101.00007FFE13287000.00000080.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692369518.00007FFE13288000.00000004.00000001.01000000.00000007.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13270000_run0796.jbxd
                                    Similarity
                                    • API ID: htons
                                    • String ID: htons: Python int too large to convert to C 16-bit unsigned integer (The silent truncation is deprecated)$htons: can't convert negative Python int to C 16-bit unsigned integer$i:htons
                                    • API String ID: 4207154920-4284149983
                                    • Opcode ID: 729e96e7b12afc6b5897316c3b0dbc4f4c5b66e951e21554fbea4e40ff9651a1
                                    • Instruction ID: ffceac9bdfa54245f3dc71bf3e574b2851e019b0ad4536b34095e7371e00668f
                                    • Opcode Fuzzy Hash: 729e96e7b12afc6b5897316c3b0dbc4f4c5b66e951e21554fbea4e40ff9651a1
                                    • Instruction Fuzzy Hash: 95012121B18E438AFA10BB27D89017423B0BFF5BA5F5004B1D94EA7570DE6EE805C740
                                    Function 00007FFE13278534 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 32networkCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    • ntohs: Python int too large to convert to C 16-bit unsigned integer (The silent truncation is deprecated), xrefs: 00007FFE13278585
                                    • ntohs: can't convert negative Python int to C 16-bit unsigned integer, xrefs: 00007FFE13278560
                                    • i:ntohs, xrefs: 00007FFE13278540
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692291900.00007FFE13271000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFE13270000, based on PE: true
                                    • Associated: 00000002.00000002.1692276597.00007FFE13270000.00000002.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13281000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13283000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13286000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692354101.00007FFE13287000.00000080.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692369518.00007FFE13288000.00000004.00000001.01000000.00000007.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13270000_run0796.jbxd
                                    Similarity
                                    • API ID: htons
                                    • String ID: i:ntohs$ntohs: Python int too large to convert to C 16-bit unsigned integer (The silent truncation is deprecated)$ntohs: can't convert negative Python int to C 16-bit unsigned integer
                                    • API String ID: 4207154920-2105665782
                                    • Opcode ID: e796ab97eb9230b9202cf1ef48d8ea29262147f76c6ebbc76763d0961c0534d0
                                    • Instruction ID: d84a6850491adc06d7a80f3e67fa2ceec0f5754cc3d573c7f1b30cccc757bbe8
                                    • Opcode Fuzzy Hash: e796ab97eb9230b9202cf1ef48d8ea29262147f76c6ebbc76763d0961c0534d0
                                    • Instruction Fuzzy Hash: D201DA61F08E4389EA10AB27EC9117527B0BFF4BE5F5040B1D94EAB5B0EE6DE549C740
                                    Function 00007FFE132781C0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 29COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692291900.00007FFE13271000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFE13270000, based on PE: true
                                    • Associated: 00000002.00000002.1692276597.00007FFE13270000.00000002.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13281000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13283000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13286000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692354101.00007FFE13287000.00000080.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692369518.00007FFE13288000.00000004.00000001.01000000.00000007.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13270000_run0796.jbxd
                                    Similarity
                                    • API ID: inet_addr
                                    • String ID: 255.255.255.255$illegal IP address string passed to inet_aton$s:inet_aton
                                    • API String ID: 1393076350-4110412280
                                    • Opcode ID: a1e12168fce0f0faf93cf48384a411813160d1229747e6eb0ce927bb8162e8e8
                                    • Instruction ID: 4395e427dc76f254b7b8a5e8c2f54ea0f4a5ebd060fd6f5ae5ae38e20dc730af
                                    • Opcode Fuzzy Hash: a1e12168fce0f0faf93cf48384a411813160d1229747e6eb0ce927bb8162e8e8
                                    • Instruction Fuzzy Hash: 92011A61A08E4289EA00BB2BE8541792770FFF57B5F6045B1D61EA65B4DF2DD409C700
                                    Function 00007FFE1330C380 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON
                                    Download Yara Rule
                                    APIs
                                    • __C_specific_handler.LIBVCRUNTIME ref: 00007FFE1330C389
                                      • Part of subcall function 00007FFE1330C680: _IsNonwritableInCurrentImage.LIBCMT ref: 00007FFE1330C740
                                      • Part of subcall function 00007FFE1330C680: RtlUnwindEx.KERNEL32(?,?,?,?,?,?,?,00007FFE1330C38E), ref: 00007FFE1330C78F
                                    • terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1330C3A1
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: C_specific_handlerCurrentImageNonwritableUnwindterminate
                                    • String ID: csm$f
                                    • API String ID: 2215565074-629598281
                                    • Opcode ID: a100106faf02f9425695e37ff6904bd06c41ae4876ec1667ba193be14bb0b118
                                    • Instruction ID: cd1c574223480282b3d669345a1c53b073835e17be4a6c2af990a6800ae61ace
                                    • Opcode Fuzzy Hash: a100106faf02f9425695e37ff6904bd06c41ae4876ec1667ba193be14bb0b118
                                    • Instruction Fuzzy Hash: 72D05E21D28B46C9FF381A73908523C26845F34734F0884F0CA2C1C2E18E1E98E9421B
                                    Function 00007FFE01381844 Relevance: 6.3, APIs: 5, Instructions: 76COMMON
                                    Download Yara Rule
                                    APIs
                                    • EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,00007FFE0138161E), ref: 00007FFE01381864
                                    • EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,00007FFE0138161E), ref: 00007FFE013818BA
                                    • EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,00007FFE0138161E), ref: 00007FFE01381919
                                    • LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,00007FFE0138161E), ref: 00007FFE0138192F
                                    • LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,?,00007FFE0138161E), ref: 00007FFE01381948
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: CriticalSection$Enter$Leave
                                    • String ID:
                                    • API String ID: 2801635615-0
                                    • Opcode ID: 302044b92b2308bce7121270ea834612e31e28d4b7090ae58e8a9f8d8bdd8df1
                                    • Instruction ID: b76765e167107d7f26cd888f6e33174e32c2b52965da9987ba80723076eb1d0f
                                    • Opcode Fuzzy Hash: 302044b92b2308bce7121270ea834612e31e28d4b7090ae58e8a9f8d8bdd8df1
                                    • Instruction Fuzzy Hash: 1C318F22A18B9286F7548F11A84427DA764FB94BA4F1A1235DDAE0B7B1DE7CE582C300
                                    Function 00007FFE01421DC0 Relevance: 6.1, APIs: 4, Instructions: 144fileCOMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: FileWrite$ConsoleErrorLast
                                    • String ID:
                                    • API String ID: 765721374-0
                                    • Opcode ID: d79d0a6dc17aab93c60b94be928b241413c0b385ad5ba48a6bb4bfa34089292c
                                    • Instruction ID: 3cc39b3326d059997e8eb3a6f184028ffee2ce6eed753cad8f2780d92613d961
                                    • Opcode Fuzzy Hash: d79d0a6dc17aab93c60b94be928b241413c0b385ad5ba48a6bb4bfa34089292c
                                    • Instruction Fuzzy Hash: 7E51CD32F1469289E710CF61E8906AD3BB0BB64B98F454132DE5E5BAB4DF3CD186C701
                                    Function 00007FFE0138CEB0 Relevance: 6.1, APIs: 4, Instructions: 118COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFE013A28D6,?,?,?,?,?,?,?,00000040), ref: 00007FFE0138CEEC
                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFE013A28D6,?,?,?,?,?,?,?,00000040), ref: 00007FFE0138CF3E
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: ErrorLast
                                    • String ID:
                                    • API String ID: 1452528299-0
                                    • Opcode ID: 524cda4936ba2ef802744aff912098b033c9da1022ee252861117ab8191c56bd
                                    • Instruction ID: bf3f411f123100bf79aff95db838f346ae9295734a1cbdb0cbc7bb0927e7564f
                                    • Opcode Fuzzy Hash: 524cda4936ba2ef802744aff912098b033c9da1022ee252861117ab8191c56bd
                                    • Instruction Fuzzy Hash: 5951BB21E0D75686FB559B24E5402BD73A0EF45B98F255234DA6D4F7F2EF2CB8918300
                                    Function 00007FFE13309B40 Relevance: 6.1, APIs: 4, Instructions: 94COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: Name::operator+=
                                    • String ID:
                                    • API String ID: 3821211099-0
                                    • Opcode ID: ff692e02c459a60db3a90965a0e40e8b060188389d68a8067c539dd7fc5ea092
                                    • Instruction ID: 4d99f5074c43d85f83a8a81fae006cf7251b43aaa98e8d21fa8a6458a0534916
                                    • Opcode Fuzzy Hash: ff692e02c459a60db3a90965a0e40e8b060188389d68a8067c539dd7fc5ea092
                                    • Instruction Fuzzy Hash: 0C416D62F08F528DEB10DF53D8800BD67A5BB24BA4F444872DE6C67AB9DE38D551C308
                                    Function 00007FFE132755D4 Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692291900.00007FFE13271000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFE13270000, based on PE: true
                                    • Associated: 00000002.00000002.1692276597.00007FFE13270000.00000002.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13281000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13283000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13286000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692354101.00007FFE13287000.00000080.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692369518.00007FFE13288000.00000004.00000001.01000000.00000007.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13270000_run0796.jbxd
                                    Similarity
                                    • API ID: ConditionMask$InfoVerifyVersion
                                    • String ID:
                                    • API String ID: 2793162063-0
                                    • Opcode ID: 915e44011b00c5956dca37e0df7ef38024c7c35bec0575d793d4045e04d37780
                                    • Instruction ID: 11ea763d6137c27601606977049d50c8c2af5ab7f24b17141fc7dba3aafab002
                                    • Opcode Fuzzy Hash: 915e44011b00c5956dca37e0df7ef38024c7c35bec0575d793d4045e04d37780
                                    • Instruction Fuzzy Hash: 0C311D35A09B81CAEB20DF12E4447A973A0FBE8B54F444175CA8D67B68DF3CE549CB10
                                    Function 00007FFE013884B0 Relevance: 6.1, APIs: 4, Instructions: 70COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: ErrorLast
                                    • String ID:
                                    • API String ID: 1452528299-0
                                    • Opcode ID: b48df02448ea6c3c3e81b37e96f7fbedd635f325f2f5f48e109908653462f0fb
                                    • Instruction ID: 9c627665696ffa4dfde566215e981ec8eb61393ad641fe4bcdc0af1ef9dc3d50
                                    • Opcode Fuzzy Hash: b48df02448ea6c3c3e81b37e96f7fbedd635f325f2f5f48e109908653462f0fb
                                    • Instruction Fuzzy Hash: 2221A120E0D70382FB54A774A95517DA2A55F843A8F56077CD42E4F6FAEF2CF8058310
                                    Function 00007FFE01393850 Relevance: 6.1, APIs: 4, Instructions: 68COMMON
                                    Download Yara Rule
                                    APIs
                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE01393861
                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE013938AB
                                      • Part of subcall function 00007FFE013938F0: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFE013C7AE1,?,?,?,?,00007FFE01385036,?,?,?,00007FFE01383CB3,?,?,?), ref: 00007FFE013938FA
                                      • Part of subcall function 00007FFE013938F0: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFE013C7AE1,?,?,?,?,00007FFE01385036,?,?,?,00007FFE01383CB3,?,?,?), ref: 00007FFE01393944
                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00007FFE013938D1
                                    • Concurrency::details::_Concurrent_queue_iterator_base_v4::~_Concurrent_queue_iterator_base_v4.LIBCPMT ref: 00007FFE013CD7E3
                                      • Part of subcall function 00007FFE0138D4D0: GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFE01393916,?,?,?,00007FFE013C7AE1,?,?,?,?,00007FFE01385036,?,?,?), ref: 00007FFE0138D549
                                      • Part of subcall function 00007FFE0138D4D0: TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00007FFE01393916,?,?,?,00007FFE013C7AE1,?,?,?,?,00007FFE01385036,?,?,?), ref: 00007FFE013C6003
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: ErrorLast$AddressConcurrency::details::_Concurrent_queue_iterator_base_v4Concurrent_queue_iterator_base_v4::~_ProcValue
                                    • String ID:
                                    • API String ID: 2828593425-0
                                    • Opcode ID: a3f83c6428281c083870adb58c7dfdc5829ba1d8a2042a875c092bef449fd859
                                    • Instruction ID: cab2901ed926134d243c8be2f30e9990432d5d94815ea881eea3b735779e62a3
                                    • Opcode Fuzzy Hash: a3f83c6428281c083870adb58c7dfdc5829ba1d8a2042a875c092bef449fd859
                                    • Instruction Fuzzy Hash: 37218E60F0D74342FB54AB70A95517D62A5AF843A4F160638E92E4F7F6EE3CF8098340
                                    Function 00007FFE0139BBB0 Relevance: 6.1, APIs: 4, Instructions: 64threadCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00007FFE0139BC48: GetModuleHandleExW.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFE0139BBD8,?,?,?,?,?,00007FFE0139BB82,?,?,?,?,?,00007FFE0139BB39), ref: 00007FFE0139BC8C
                                    • CreateThread.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,?,?,00007FFE0139BB82,?,?,?,?,?,00007FFE0139BB39), ref: 00007FFE0139BC01
                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,?,?,00007FFE0139BB82,?,?,?,?,?,00007FFE0139BB39), ref: 00007FFE013D1E0F
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: CreateErrorHandleLastModuleThread
                                    • String ID:
                                    • API String ID: 182981130-0
                                    • Opcode ID: 10b7d636ff5d98f08303ca471f79011c60a894864000ff7db2019a0b9034142f
                                    • Instruction ID: 54bcfccdfe74838c4af324861f193b38a9a0d3b7d47d3ec18f0df93023e80f51
                                    • Opcode Fuzzy Hash: 10b7d636ff5d98f08303ca471f79011c60a894864000ff7db2019a0b9034142f
                                    • Instruction Fuzzy Hash: 47216F25A0D78286FF15DB65B45057AA2A5EF85B80F5A0430DE8E4F7B9DE3CE4008B40
                                    Function 00007FFE013938F0 Relevance: 6.1, APIs: 4, Instructions: 63COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFE013C7AE1,?,?,?,?,00007FFE01385036,?,?,?,00007FFE01383CB3,?,?,?), ref: 00007FFE013938FA
                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFE013C7AE1,?,?,?,?,00007FFE01385036,?,?,?,00007FFE01383CB3,?,?,?), ref: 00007FFE01393944
                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFE013C7AE1,?,?,?,?,00007FFE01385036,?,?,?,00007FFE01383CB3,?,?,?), ref: 00007FFE01393960
                                    • Concurrency::details::_Concurrent_queue_iterator_base_v4::~_Concurrent_queue_iterator_base_v4.LIBCPMT ref: 00007FFE013CD85B
                                      • Part of subcall function 00007FFE0138D4D0: GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFE01393916,?,?,?,00007FFE013C7AE1,?,?,?,?,00007FFE01385036,?,?,?), ref: 00007FFE0138D549
                                      • Part of subcall function 00007FFE0138D4D0: TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00007FFE01393916,?,?,?,00007FFE013C7AE1,?,?,?,?,00007FFE01385036,?,?,?), ref: 00007FFE013C6003
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: ErrorLast$AddressConcurrency::details::_Concurrent_queue_iterator_base_v4Concurrent_queue_iterator_base_v4::~_ProcValue
                                    • String ID:
                                    • API String ID: 2828593425-0
                                    • Opcode ID: 2694630f62aafb5f25829a23acb7910750d305b072d7734d1a2032a41b423732
                                    • Instruction ID: ac13f0b617c74449fd5f12118aac6f214d8e90d67c8073c594cef7a3dc04eaea
                                    • Opcode Fuzzy Hash: 2694630f62aafb5f25829a23acb7910750d305b072d7734d1a2032a41b423732
                                    • Instruction Fuzzy Hash: C3219060E0D70346FB589770A5652B952A5AF843A8F060334E82E0F6F6EF2CF8058340
                                    Function 00007FFE01381D50 Relevance: 6.1, APIs: 4, Instructions: 63COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFE013C7949,?,?,?,00007FFE01385043,?,?,?,00007FFE01383CB3,?,?,?,00007FFE013F1153), ref: 00007FFE01381D5A
                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFE013C7949,?,?,?,00007FFE01385043,?,?,?,00007FFE01383CB3,?,?,?,00007FFE013F1153), ref: 00007FFE01381DA4
                                    • SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFE013C7949,?,?,?,00007FFE01385043,?,?,?,00007FFE01383CB3,?,?,?,00007FFE013F1153), ref: 00007FFE01381DC0
                                    • Concurrency::details::_Concurrent_queue_iterator_base_v4::~_Concurrent_queue_iterator_base_v4.LIBCPMT ref: 00007FFE013C67AB
                                      • Part of subcall function 00007FFE0138D4D0: GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFE01393916,?,?,?,00007FFE013C7AE1,?,?,?,?,00007FFE01385036,?,?,?), ref: 00007FFE0138D549
                                      • Part of subcall function 00007FFE0138D4D0: TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00007FFE01393916,?,?,?,00007FFE013C7AE1,?,?,?,?,00007FFE01385036,?,?,?), ref: 00007FFE013C6003
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: ErrorLast$AddressConcurrency::details::_Concurrent_queue_iterator_base_v4Concurrent_queue_iterator_base_v4::~_ProcValue
                                    • String ID:
                                    • API String ID: 2828593425-0
                                    • Opcode ID: 2f432a438df1f1b4216f799124d22d226c50d070f1c4872b7ed6e825bdfe5df5
                                    • Instruction ID: 8962c91d2d664f36a0798c5fade6e4b9ec39ac2e0577ee12774973d8c29aee68
                                    • Opcode Fuzzy Hash: 2f432a438df1f1b4216f799124d22d226c50d070f1c4872b7ed6e825bdfe5df5
                                    • Instruction Fuzzy Hash: DE216060B0D70346FB54AB60A6556BD52A59F843A8F060734D52E0F7F6EF2CF8098340
                                    Function 00007FFE13303270 Relevance: 6.1, APIs: 4, Instructions: 57COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: AdjustPointerabort
                                    • String ID:
                                    • API String ID: 3954111656-0
                                    • Opcode ID: 309a1d1c1b1e5aa468863802a9d91ddaa5992cf4c1454c0b22ad85108a3dbc05
                                    • Instruction ID: ba26705d901da4bf66b321eaf61ca7015eeb17c0da1d702a9032f765848f7239
                                    • Opcode Fuzzy Hash: 309a1d1c1b1e5aa468863802a9d91ddaa5992cf4c1454c0b22ad85108a3dbc05
                                    • Instruction Fuzzy Hash: BB218732E08F42C9EA149B57D18407E6364FF64BB5B0844B6DB2C27B66CF3CE5958748
                                    Function 00007FFE0141FC28 Relevance: 6.1, APIs: 4, Instructions: 52COMMON
                                    Download Yara Rule
                                    APIs
                                    • EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FFE0141FDA2,?,?,?,?,00007FFE013C6F55,?,?,?,00007FFE013F1153,?,?,00000000), ref: 00007FFE0141FC5E
                                    • FlushFileBuffers.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00007FFE0141FDA2,?,?,?,?,00007FFE013C6F55,?,?,?,00007FFE013F1153,?,?,00000000), ref: 00007FFE0141FC8F
                                      • Part of subcall function 00007FFE01381D50: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFE013C7949,?,?,?,00007FFE01385043,?,?,?,00007FFE01383CB3,?,?,?,00007FFE013F1153), ref: 00007FFE01381D5A
                                      • Part of subcall function 00007FFE01381D50: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFE013C7949,?,?,?,00007FFE01385043,?,?,?,00007FFE01383CB3,?,?,?,00007FFE013F1153), ref: 00007FFE01381DA4
                                    • GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,?,00007FFE0141FDA2,?,?,?,?,00007FFE013C6F55,?,?,?,00007FFE013F1153,?,?,00000000), ref: 00007FFE0141FCA3
                                    • LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,00007FFE0141FDA2,?,?,?,?,00007FFE013C6F55,?,?,?,00007FFE013F1153,?,?,00000000), ref: 00007FFE0141FCCE
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: ErrorLast$CriticalSection$BuffersEnterFileFlushLeave
                                    • String ID:
                                    • API String ID: 1312186065-0
                                    • Opcode ID: ee76ac8f46fbed5b4f5efb849bdda1e853cbd41d329b9c3ee47b2fcfb560e6d1
                                    • Instruction ID: d56cc19e68161fc3b0c00b7e99a3239543fd0e4814fb4e4cd623571d0fcc919b
                                    • Opcode Fuzzy Hash: ee76ac8f46fbed5b4f5efb849bdda1e853cbd41d329b9c3ee47b2fcfb560e6d1
                                    • Instruction Fuzzy Hash: B711B2B2B24B4682DB549F65E884239A360FB58BC5B054135DA5F4F375EF3CE0558300
                                    Function 00007FFE13304770 Relevance: 6.1, APIs: 4, Instructions: 51COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: abort$terminate
                                    • String ID:
                                    • API String ID: 579254285-0
                                    • Opcode ID: 0575d6c39966dbd82ec46a155e414ed2de6267770d3a2ba2e587cfaa28695db4
                                    • Instruction ID: 87114b723c756ff1aae3251a6e87ddbdf83871d8711c1170deef012430e16ee2
                                    • Opcode Fuzzy Hash: 0575d6c39966dbd82ec46a155e414ed2de6267770d3a2ba2e587cfaa28695db4
                                    • Instruction Fuzzy Hash: D7F08121E09F4689F9086B63E48417C5364AF78F60F1808B5EA3D22766DE2CE5504618
                                    Function 00007FFE13273F4C Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692291900.00007FFE13271000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFE13270000, based on PE: true
                                    • Associated: 00000002.00000002.1692276597.00007FFE13270000.00000002.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13281000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13283000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13286000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692354101.00007FFE13287000.00000080.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692369518.00007FFE13288000.00000004.00000001.01000000.00000007.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13270000_run0796.jbxd
                                    Similarity
                                    • API ID: ConditionMask$InfoVerifyVersion
                                    • String ID:
                                    • API String ID: 2793162063-0
                                    • Opcode ID: 8b396afc2959a7b7062373c8648dfc0c8814537d5f2e8906ce295a48b12feaba
                                    • Instruction ID: 57ebe47224837d385886ff9dda6ecd0097950eeb0070506d76d4172d264a3fa1
                                    • Opcode Fuzzy Hash: 8b396afc2959a7b7062373c8648dfc0c8814537d5f2e8906ce295a48b12feaba
                                    • Instruction Fuzzy Hash: E511E732A19A8186D720DF22E8813DAB2B1FBD8754F455139DA8D87768EB7CD109CB44
                                    Function 00007FFE13273E70 Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692291900.00007FFE13271000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFE13270000, based on PE: true
                                    • Associated: 00000002.00000002.1692276597.00007FFE13270000.00000002.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13281000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13283000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13286000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692354101.00007FFE13287000.00000080.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692369518.00007FFE13288000.00000004.00000001.01000000.00000007.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13270000_run0796.jbxd
                                    Similarity
                                    • API ID: ConditionMask$InfoVerifyVersion
                                    • String ID:
                                    • API String ID: 2793162063-0
                                    • Opcode ID: 202f66560dac0e126ab4f3184bce5b4244807b0f8ad9589e321976817cce69d4
                                    • Instruction ID: 57ebe47224837d385886ff9dda6ecd0097950eeb0070506d76d4172d264a3fa1
                                    • Opcode Fuzzy Hash: 202f66560dac0e126ab4f3184bce5b4244807b0f8ad9589e321976817cce69d4
                                    • Instruction Fuzzy Hash: E511E732A19A8186D720DF22E8813DAB2B1FBD8754F455139DA8D87768EB7CD109CB44
                                    Function 00007FFE013C25E4 Relevance: 6.0, APIs: 4, Instructions: 40timethreadCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetSystemTimeAsFileTime.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,?,?,00007FFE013889AD), ref: 00007FFE013C2611
                                    • GetCurrentThreadId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00007FFE013889AD), ref: 00007FFE013C261F
                                    • GetCurrentProcessId.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00007FFE013889AD), ref: 00007FFE013C262B
                                    • QueryPerformanceCounter.API-MS-WIN-CORE-PROFILE-L1-1-0(?,?,?,00007FFE013889AD), ref: 00007FFE013C263B
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                    • String ID:
                                    • API String ID: 2933794660-0
                                    • Opcode ID: d503fa05623a57c4eeef4bffdf31ee343c622b4c9e351dd5a0394b126dd876f0
                                    • Instruction ID: 7ee4f2f2b8a7c0680a4d71a833cb38c083ab23dc0dab2ca436284c643f95426d
                                    • Opcode Fuzzy Hash: d503fa05623a57c4eeef4bffdf31ee343c622b4c9e351dd5a0394b126dd876f0
                                    • Instruction Fuzzy Hash: 9311FA32B09F428AEB108F75E8950A933A4FB5DB5CB441A35EA5D8B774DF7CD1A48340
                                    Function 00007FFE1330D364 Relevance: 6.0, APIs: 4, Instructions: 40timethreadCOMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                    • String ID:
                                    • API String ID: 2933794660-0
                                    • Opcode ID: 1fefa3f07759f2b27021d6aa4cfab479302c24b9d86d53738b153a3556951b4d
                                    • Instruction ID: 0324f9b4a633553f442b27604a2903689c3a9e2ff3d4ef97b7147d60f518ec75
                                    • Opcode Fuzzy Hash: 1fefa3f07759f2b27021d6aa4cfab479302c24b9d86d53738b153a3556951b4d
                                    • Instruction Fuzzy Hash: 0D113062B04F418AEB10CF72E8541A933A4F71D768B041A71EA6D87764DF3CD1A48354
                                    Function 00007FF60F18A920 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1691492610.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000002.00000002.1691469586.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691519836.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691591884.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                    • String ID:
                                    • API String ID: 2933794660-0
                                    • Opcode ID: be9da76585353bf4ff120931e3f5bbaf95a19439f17c7ee9af2afa7da57e9186
                                    • Instruction ID: 20bef7217564d57e6d6b8efc10b3d3bbabe09ce231f67aa7425c7cde3d1d0e13
                                    • Opcode Fuzzy Hash: be9da76585353bf4ff120931e3f5bbaf95a19439f17c7ee9af2afa7da57e9186
                                    • Instruction Fuzzy Hash: 0A111836B18B029AEB008F61E8552B833A4FB19758F540E31EA6D867A4DF7CD1998380
                                    Function 00007FFE133050B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: Name::operator+Name::operator+=Name::operator=
                                    • String ID: CV:
                                    • API String ID: 2521687178-3725821052
                                    • Opcode ID: d0ba46de3f1c83a20ab42dfcfcdc110b5b72e88ff0278ae87969a8fad92ba96a
                                    • Instruction ID: 5ea687ff24a3e4f294ea5542c4fa45a26b7604d9726f419ad1469755f71c08ce
                                    • Opcode Fuzzy Hash: d0ba46de3f1c83a20ab42dfcfcdc110b5b72e88ff0278ae87969a8fad92ba96a
                                    • Instruction Fuzzy Hash: 45519B62E0CE86DDFB19CB62D8502BD27B1AF647A4F8440B1D96D677F6CE2CA445C308
                                    Function 00007FFE01385FF0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101libraryloaderCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00007FFE0138E040: HeapAlloc.API-MS-WIN-CORE-HEAP-L1-1-0(?,?,00000000,00007FFE013CD82A,?,?,?,00007FFE013C7AE1,?,?,?,?,00007FFE01385036,?,?,?), ref: 00007FFE0138E088
                                    • InitializeCriticalSectionAndSpinCount.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,?,?,00000000,00007FFE013818FB,?,?,?,?,?,00007FFE0138161E), ref: 00007FFE013C7DB6
                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,?,00000000,00007FFE013818FB,?,?,?,?,?,00007FFE0138161E), ref: 00007FFE013C7DCC
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: AddressAllocCountCriticalHeapInitializeProcSectionSpin
                                    • String ID: InitializeCriticalSectionEx
                                    • API String ID: 1188775705-3084827643
                                    • Opcode ID: 703f7b587c740a315befa96fa6719fbfaa469b782927c6126cfb9385a7780fe7
                                    • Instruction ID: 478805ef2bf3b7e74eccb7b06a3c0090b022b0fc9a5613e8a58b48cf17feaf00
                                    • Opcode Fuzzy Hash: 703f7b587c740a315befa96fa6719fbfaa469b782927c6126cfb9385a7780fe7
                                    • Instruction Fuzzy Hash: 4E41B062B18B4282EB148B29E41427D77A1BB957A8F594335EE6D4F7F8DF3CE4018700
                                    Function 00007FFE01422184 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98fileCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: ErrorFileLastWrite
                                    • String ID: U
                                    • API String ID: 442123175-4171548499
                                    • Opcode ID: 4863c300516b6a9dedc084c1348bf3084e7177d5d3d42e52d2e91a76a9248602
                                    • Instruction ID: 74dba5abd357a9bb923bd1894801273a3cca9b2e4faa3f197509da55027e14e6
                                    • Opcode Fuzzy Hash: 4863c300516b6a9dedc084c1348bf3084e7177d5d3d42e52d2e91a76a9248602
                                    • Instruction Fuzzy Hash: 4C31E022B18A4186EB208F65E4447AEB7A0FB98794F814031EE4D8BBB8EF7CD441C751
                                    Function 00007FFE013B36F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 80COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: _handle_errorf
                                    • String ID: "$powf
                                    • API String ID: 2315412904-603753351
                                    • Opcode ID: 0f5bcb0aa6d35f86e40bcd6dc930a44beb6cf17166eead1c5b5978abef3f93d2
                                    • Instruction ID: 459fdb61b4436fc5a4244e4ce654745e6619b047739f020746e092fb8ad2e831
                                    • Opcode Fuzzy Hash: 0f5bcb0aa6d35f86e40bcd6dc930a44beb6cf17166eead1c5b5978abef3f93d2
                                    • Instruction Fuzzy Hash: 52416073D28680DBD370CF22E4847AABAA0F799348F112329F749069A8DF7DD554AB44
                                    Function 00007FFE013E9C54 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75libraryloaderCOMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,00000000,00007FFE013C840B,?,?,?,?,?,?,00000000,00000098,00000000,00007FFE013EC258), ref: 00007FFE013E9CBE
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: AddressProc
                                    • String ID: LCIDToLocaleName$LocaleNameToLCID
                                    • API String ID: 190572456-2637756803
                                    • Opcode ID: d2f67aa584737989cd60aa142cfc7d9170daa0443f015e61b3e60402520badb7
                                    • Instruction ID: da1954a61fe025815f3c030524b7ba0b09a6b82272d8d8a77b41646948fd7d2e
                                    • Opcode Fuzzy Hash: d2f67aa584737989cd60aa142cfc7d9170daa0443f015e61b3e60402520badb7
                                    • Instruction Fuzzy Hash: 1D218E60B1DB4282FF099719E91027963E1AF147E8F454731DE2D9B7F8EE2CE8518300
                                    Function 00007FFE013E93EC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73libraryloaderCOMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,?,00000000,00000098,00007FFE013EBA01,?,?,00000098,00007FFE013C6C48,000000B8,000000BC,000001C2,?,?), ref: 00007FFE013E9460
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: AddressProc
                                    • String ID: EnumSystemLocalesEx$LCIDToLocaleName
                                    • API String ID: 190572456-3704287933
                                    • Opcode ID: e031951836a15d870668f8db9beeab4be1d8df7f09d18e85a6ff08e926df0380
                                    • Instruction ID: e189a3e47f79268de144c255ca2adc3cf655d5546f95ea159e852d9d0b35862d
                                    • Opcode Fuzzy Hash: e031951836a15d870668f8db9beeab4be1d8df7f09d18e85a6ff08e926df0380
                                    • Instruction Fuzzy Hash: 98318272A1DB0282EB05CB25E81066A63A1FB543A8F414735EE6D5B7F8EF7CE445CB00
                                    Function 00007FFE013E9B50 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69libraryloaderCOMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: AddressProc
                                    • String ID: LCIDToLocaleName$LCMapStringEx
                                    • API String ID: 190572456-3928102921
                                    • Opcode ID: 066ec8f9d7d7c0c38e437a62451d49de7ffa05a0090a9c9b25d44b5805199569
                                    • Instruction ID: f3891d324a0c6803be44cac8edfefc830f9ce7069a1479b5e1bc47a5831530a3
                                    • Opcode Fuzzy Hash: 066ec8f9d7d7c0c38e437a62451d49de7ffa05a0090a9c9b25d44b5805199569
                                    • Instruction Fuzzy Hash: 1B214F61B1DB1386EF049B29E95027963A1AF54BE8F554735DD2D4B7F8DE3CE8418300
                                    Function 00007FFE01388B20 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66libraryloaderCOMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFE013CD813,?,?,?,00007FFE013C7AE1,?,?,?,?,00007FFE01385036,?,?,?), ref: 00007FFE01388BA9
                                    • TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00007FFE013CD813,?,?,?,00007FFE013C7AE1,?,?,?,?,00007FFE01385036,?,?,?), ref: 00007FFE013C8606
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: AddressProcValue
                                    • String ID: FlsSetValue
                                    • API String ID: 1414840956-3750699315
                                    • Opcode ID: 141a6e68d7d00231ce51b312d1e9fc3fa37c404d4c6573b92cb4a8d8eaf1be28
                                    • Instruction ID: 47d5c8adb366c1885ee855b2fd607a69fed0057e7efeec9dcada1732f5d89070
                                    • Opcode Fuzzy Hash: 141a6e68d7d00231ce51b312d1e9fc3fa37c404d4c6573b92cb4a8d8eaf1be28
                                    • Instruction Fuzzy Hash: D1215161B19B0286FF059B15E8101796361AF487E4F498735DD2E4F7F8DF3CE8418200
                                    Function 00007FFE01386660 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64libraryloaderCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,00002000,00007FFE01384995,?,?,00000000,00007FFE013848E1,?,?,?,00007FFE01384664), ref: 00007FFE013866E3
                                    • InitializeCriticalSectionAndSpinCount.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00002000,00007FFE01384995,?,?,00000000,00007FFE013848E1,?,?,?,00007FFE01384664), ref: 00007FFE013C8075
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: AddressCountCriticalInitializeProcSectionSpin
                                    • String ID: InitializeCriticalSectionEx
                                    • API String ID: 1498394645-3084827643
                                    • Opcode ID: ddf4b0a480a43b402f6ace76273d01146ff806f56be996b468f3267f4dc4eb8a
                                    • Instruction ID: 20c7dc8e08b5d9c12198676c35123ed6ebd5281e11ecd3c781d594071933e0ad
                                    • Opcode Fuzzy Hash: ddf4b0a480a43b402f6ace76273d01146ff806f56be996b468f3267f4dc4eb8a
                                    • Instruction Fuzzy Hash: 8E215C61B19B5382FB588B15E91123922A2AF887A8F555335DD2E0FBF8EE3CE4418300
                                    Function 00007FFE133083F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00007FFE133084DC: DName::operator+.LIBVCRUNTIME ref: 00007FFE13308545
                                    • DName::operator+=.LIBVCRUNTIME ref: 00007FFE1330847C
                                      • Part of subcall function 00007FFE1330B638: DName::operator+=.LIBVCRUNTIME ref: 00007FFE1330B653
                                      • Part of subcall function 00007FFE1330B554: DName::operator=.LIBVCRUNTIME ref: 00007FFE1330B581
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: Name::operator+=$Name::operator+Name::operator=
                                    • String ID: void
                                    • API String ID: 3725178723-3531332078
                                    • Opcode ID: 9b968bc2e922b99509c453ea154173d36d1b892fe03fcd21ec92663b842f2082
                                    • Instruction ID: dc15ec9c333a2805922788d092188c45f359fc1cfda4b7f9cf9dde198324b974
                                    • Opcode Fuzzy Hash: 9b968bc2e922b99509c453ea154173d36d1b892fe03fcd21ec92663b842f2082
                                    • Instruction Fuzzy Hash: FE315462E18E468DFF10CB66D8513BC2B70EB24768F5440B1DA2C6A6BADF6CD4C5C358
                                    Function 00007FFE0138E420 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63libraryloaderCOMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,000067EBB6D5B716,00007FFE0138D7A6,?,?,?,?,?,?,?,00007FFE0138A022), ref: 00007FFE013CA712
                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,000067EBB6D5B716,00007FFE0138D7A6,?,?,?,?,?,?,?,00007FFE0138A022), ref: 00007FFE013CA728
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: AddressProcValue
                                    • String ID: FlsSetValue
                                    • API String ID: 1414840956-3750699315
                                    • Opcode ID: fe0a1bbddaf81aa03f7c9a5abef65909dc359e7693faf75625a7cf74660712c5
                                    • Instruction ID: 32ac539273ac187bb2e12a6908422c8a0b78221671d3f0cef629b41fcb38f1c8
                                    • Opcode Fuzzy Hash: fe0a1bbddaf81aa03f7c9a5abef65909dc359e7693faf75625a7cf74660712c5
                                    • Instruction Fuzzy Hash: 67214F61B19B0342FF448B25E91027923A2AF487E8F559739D92E1F7F8EE3CE8458300
                                    Function 00007FFE0138E480 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63libraryloaderCOMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,000067EBB6D5B716,00007FFE0138D819,?,?,?,?,?,?,?,00007FFE0138A022), ref: 00007FFE013CA7AD
                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,000067EBB6D5B716,00007FFE0138D819,?,?,?,?,?,?,?,00007FFE0138A022), ref: 00007FFE013CA7C3
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: AddressProcValue
                                    • String ID: FlsSetValue
                                    • API String ID: 1414840956-3750699315
                                    • Opcode ID: c4172e71829929f4f5fe8b0b90eeccfd7986301197f64af4a82082aad63af629
                                    • Instruction ID: 2a98adbddf9cea43453c1873b2adcf1c2ac383a6e2a2096db12195f22e14623e
                                    • Opcode Fuzzy Hash: c4172e71829929f4f5fe8b0b90eeccfd7986301197f64af4a82082aad63af629
                                    • Instruction Fuzzy Hash: 45214161B19B0342FB448B65E91017923A2AF487E4F459735D92E5F7F8EE3CE8458300
                                    Function 00007FFE1330880C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 63COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: Name::operator+
                                    • String ID: void$void
                                    • API String ID: 2943138195-3746155364
                                    • Opcode ID: 9fed0904b7036b1a7e7c47886692c4ade50ba0f084095a30f4e99b30a35ca245
                                    • Instruction ID: 0405d830f4e683d8ba2698bca973f5db5378dc628002e5f02911bfe8b3862a3f
                                    • Opcode Fuzzy Hash: 9fed0904b7036b1a7e7c47886692c4ade50ba0f084095a30f4e99b30a35ca245
                                    • Instruction Fuzzy Hash: 77314A72E18F569CFB01CB62E8800ED37B0BB68758B440176EA6E66B66DF3CD144C718
                                    Function 00007FFE013E950C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62libraryloaderCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFE013E8F04,?,?,?,?,00007FFE013C8501), ref: 00007FFE013E9575
                                    • TlsFree.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00007FFE013E8F04,?,?,?,?,00007FFE013C8501), ref: 00007FFE013E95A9
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: AddressFreeProc
                                    • String ID: FlsFree
                                    • API String ID: 4110577592-3081468905
                                    • Opcode ID: c3b89851103aa9b012822ebfa07cb1b7bb2dac97f545a164cff3b4fa4cb9a974
                                    • Instruction ID: 3500f8c7aa151e0a963e4ff974be3ece06575bf64f6afb27e96139525986dd77
                                    • Opcode Fuzzy Hash: c3b89851103aa9b012822ebfa07cb1b7bb2dac97f545a164cff3b4fa4cb9a974
                                    • Instruction Fuzzy Hash: F7214F61B1DB4282FF098729E81027923A1AF547E8F455335DD2D5F7F8EE6CE8458301
                                    Function 00007FFE0139ACC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61libraryloadertimeCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFE0139AB84,?,?,?,00007FFE0139AB3D), ref: 00007FFE0139AD3B
                                    • GetSystemTimeAsFileTime.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,?,?,00007FFE0139AB84,?,?,?,00007FFE0139AB3D), ref: 00007FFE013D1C00
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: Time$AddressFileProcSystem
                                    • String ID: GetSystemTimePreciseAsFileTime
                                    • API String ID: 1981195492-595813830
                                    • Opcode ID: 436b3a9aaec52841e0b9d771b7ae3c9b7f3300fe22404c01370292b75ca1e7e3
                                    • Instruction ID: 137e03ea8f030e2c28d3a1ff1952ac84277effd9ea7a360dbd430f15c5940ded
                                    • Opcode Fuzzy Hash: 436b3a9aaec52841e0b9d771b7ae3c9b7f3300fe22404c01370292b75ca1e7e3
                                    • Instruction Fuzzy Hash: 95215EA1B19B0282FF588B25E91017963A1AF487A8F599335DD2E5F7F4EE7CE4458300
                                    Function 00007FFE0138D4D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61libraryloaderCOMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFE01393916,?,?,?,00007FFE013C7AE1,?,?,?,?,00007FFE01385036,?,?,?), ref: 00007FFE0138D549
                                    • TlsGetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00007FFE01393916,?,?,?,00007FFE013C7AE1,?,?,?,?,00007FFE01385036,?,?,?), ref: 00007FFE013C6003
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: AddressProcValue
                                    • String ID: FlsGetValue
                                    • API String ID: 1414840956-662576866
                                    • Opcode ID: 0aa447bb164f84aace856ea3207806c9d7ff746207915637949a022d62aedaa7
                                    • Instruction ID: 5e5cfeeb25ce74ebb9a7e0f716de6363860b88e9600de9c30b534741dab76a4b
                                    • Opcode Fuzzy Hash: 0aa447bb164f84aace856ea3207806c9d7ff746207915637949a022d62aedaa7
                                    • Instruction Fuzzy Hash: 65215061B19B0282FF088B25E95017923A1AF487A4F55573AE92E5F7F8EE3CE4458311
                                    Function 00007FFE01386390 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59librarymemoryloaderCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,?,00007FFE013874AB,?,?,?,?,00007FFE013875B1,?,?,00000000,00007FFE01388AE1), ref: 00007FFE01386407
                                    • TlsAlloc.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,?,00007FFE013874AB,?,?,?,?,00007FFE013875B1,?,?,00000000,00007FFE01388AE1), ref: 00007FFE0138643F
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: AddressAllocProc
                                    • String ID: FlsAlloc
                                    • API String ID: 2924745751-671089009
                                    • Opcode ID: 6f3942be4f8eb5dad98a1116d30526fec4c5fa6834764893a013cf6c816b3689
                                    • Instruction ID: 81f3f198e4392aaea303c42f742d137034aeaceb3196768447358f4a4d988634
                                    • Opcode Fuzzy Hash: 6f3942be4f8eb5dad98a1116d30526fec4c5fa6834764893a013cf6c816b3689
                                    • Instruction Fuzzy Hash: D2218E61B19B0382FF449B25E95013923A2AF487E4F459739E92D0F7F8EE7CE4458300
                                    Function 00007FFE013B35C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: _handle_error
                                    • String ID: "$pow
                                    • API String ID: 1757819995-713443511
                                    • Opcode ID: ede202a549bcfe3015e3b7a4bce954d34602f1d43060412508e8ac6ac717d3a8
                                    • Instruction ID: 3d1d694d02c709306eddca86dedb7185b68877056759e46854fa4c732b200f3f
                                    • Opcode Fuzzy Hash: ede202a549bcfe3015e3b7a4bce954d34602f1d43060412508e8ac6ac717d3a8
                                    • Instruction Fuzzy Hash: A2214172D1CAC587D370CF10E48176ABAA0FBDA354F211325F7890AA64EBBDD1459F00
                                    Function 00007FFE0139C710 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55libraryloaderCOMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-1-0(?,?,000001C2,00007FFE0138A2BD), ref: 00007FFE0139C773
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: AddressProc
                                    • String ID: AreFileApisANSI$CompareStringEx
                                    • API String ID: 190572456-3979650549
                                    • Opcode ID: 342e9442b81f71762d44531511e133278f5ebb6217a5cb3553a5f3ea75293761
                                    • Instruction ID: 6107969c72fc05efd0fae3cd002119aa8b8a0e0a76128d7d179947cffd0f6768
                                    • Opcode Fuzzy Hash: 342e9442b81f71762d44531511e133278f5ebb6217a5cb3553a5f3ea75293761
                                    • Instruction Fuzzy Hash: 92114FA1B19A0346FF448729E95017913A25F493A8F596736D83D0F7F4EE3CE845C210
                                    Function 00007FFE013AE410 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: _handle_errorf
                                    • String ID: !$_logbf
                                    • API String ID: 2315412904-399603704
                                    • Opcode ID: 9f5e5259284b0ed6f76e847bfe8c634ff3a56e8073b74e58c5c4e1ec8c22e376
                                    • Instruction ID: f9c7a10417d13aca0ed0e54c0dc1300aa5ae563971ea757c1f072e7d489e3cc7
                                    • Opcode Fuzzy Hash: 9f5e5259284b0ed6f76e847bfe8c634ff3a56e8073b74e58c5c4e1ec8c22e376
                                    • Instruction Fuzzy Hash: 4C11B972D28B8147E360CA21D4847797555FBD5348F604339F6496A9F5DFBCE4C4AB00
                                    Function 00007FFE013AE320 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: _handle_error_raise_exc
                                    • String ID: "$_logb
                                    • API String ID: 1935476177-1481363779
                                    • Opcode ID: 8554f4c38aff2a1c86db1cb0ec2e4fa02653d7767733f84c79fdfb50ac8ab648
                                    • Instruction ID: b615c5ebe934f1168e7ec9c94a0cfaae024619bf4884b0668dc38f682c59fd0f
                                    • Opcode Fuzzy Hash: 8554f4c38aff2a1c86db1cb0ec2e4fa02653d7767733f84c79fdfb50ac8ab648
                                    • Instruction Fuzzy Hash: 6011E361F58B8142EB14DB21940033A6153DF9ABB0F904331F93E1A7E4DF7CE0858B00
                                    Function 00007FFE1330DA0E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 00007FFE1330C1D0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,00007FFE13302F17), ref: 00007FFE1330C1E7
                                      • Part of subcall function 00007FFE1330C1D0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,00007FFE13302F17), ref: 00007FFE1330C1FE
                                      • Part of subcall function 00007FFE1330C1D0: terminate.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,00007FFE13302F17), ref: 00007FFE1330C219
                                      • Part of subcall function 00007FFE1330C1D0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,00007FFE13302F17), ref: 00007FFE1330C22D
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1330DA6E
                                    • abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE1330DA8D
                                      • Part of subcall function 00007FFE13301B60: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFE13301B73
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692400554.00007FFE13301000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FFE13300000, based on PE: true
                                    • Associated: 00000002.00000002.1692385564.00007FFE13300000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692417219.00007FFE1330E000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692436386.00007FFE13312000.00000004.00000001.01000000.00000006.sdmpDownload File
                                    • Associated: 00000002.00000002.1692454073.00007FFE13313000.00000002.00000001.01000000.00000006.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13300000_run0796.jbxd
                                    Similarity
                                    • API ID: abort$terminate
                                    • String ID: csm
                                    • API String ID: 579254285-1018135373
                                    • Opcode ID: 009a99e405968afe9082b478891bf969a292b7194393816fbdb550564c4b69a5
                                    • Instruction ID: 642ada016d08e0dcdfe52132f851d7749d0cdc7a6bd76d441fe7098c504169dd
                                    • Opcode Fuzzy Hash: 009a99e405968afe9082b478891bf969a292b7194393816fbdb550564c4b69a5
                                    • Instruction Fuzzy Hash: B8015E22A49F42CDEB249F2BD84417C22E0EF39B69F040574DD1D2B365EF28E9418208
                                    Function 00007FFE013AEF52 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: _handle_error
                                    • String ID: !$sqrt
                                    • API String ID: 1757819995-799759792
                                    • Opcode ID: 41087aa92c074fd2461e6bbe5b23ab73c846575d7d880c89778c5c11fc57a0f7
                                    • Instruction ID: 2f0a38c8854b7dacc73d511ac3f1c21fe8382e7fe32aa024b0c74a7a2322fa1e
                                    • Opcode Fuzzy Hash: 41087aa92c074fd2461e6bbe5b23ab73c846575d7d880c89778c5c11fc57a0f7
                                    • Instruction Fuzzy Hash: 2D11A776D18B8686DF11CF11A50032A6666FF967E4F614331FA6C0A7E8EF3CE0459A00
                                    Function 00007FFE013AF022 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: _handle_errorf
                                    • String ID: !$sqrtf
                                    • API String ID: 2315412904-3181196081
                                    • Opcode ID: da464d9161ddbc70d0fa62e9955e3ff7c787bf03f1219012581fd81f082c77bc
                                    • Instruction ID: c570bc4ad4fd88be8edf4a663b0411bbe578c828fa57971896c7c1a16e19255b
                                    • Opcode Fuzzy Hash: da464d9161ddbc70d0fa62e9955e3ff7c787bf03f1219012581fd81f082c77bc
                                    • Instruction Fuzzy Hash: 7A01C836D587C587E750CB22944126EB262FBD5344F648334F64846AF8DF7CE0459F00
                                    Function 00007FFE013B4070 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: _handle_error_raise_exc
                                    • String ID: !$cos
                                    • API String ID: 1935476177-1949035351
                                    • Opcode ID: 926f023dcb395efe29e9f9cf21788b62c9e0ed12d1d37f035fbb2f4997938131
                                    • Instruction ID: 1cd9d7cd6831e9528d063e7dee987decd3669e8067e6b69133e4624053dce65f
                                    • Opcode Fuzzy Hash: 926f023dcb395efe29e9f9cf21788b62c9e0ed12d1d37f035fbb2f4997938131
                                    • Instruction Fuzzy Hash: 70019232E18B8582DB14CF22A8803766162FB9A794F504334EA5E0BB99EF7CD1515B04
                                    Function 00007FF60F19F09C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1691492610.00007FF60F181000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF60F180000, based on PE: true
                                    • Associated: 00000002.00000002.1691469586.00007FF60F180000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691519836.00007FF60F1AA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1BD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1C0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691545021.00007FF60F1CC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                    • Associated: 00000002.00000002.1691591884.00007FF60F1CE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ff60f180000_run0796.jbxd
                                    Similarity
                                    • API ID: DriveType_invalid_parameter_noinfo
                                    • String ID: :
                                    • API String ID: 2595371189-336475711
                                    • Opcode ID: 5bb9208f1dd75f8da1bf4b84d43d2649c4580fde4fdc4700cc46879c1844a841
                                    • Instruction ID: 97a8c2114975a70ad4bed66a35c0286bc09d0236b21a536dcbfbd50ef7ff54a8
                                    • Opcode Fuzzy Hash: 5bb9208f1dd75f8da1bf4b84d43d2649c4580fde4fdc4700cc46879c1844a841
                                    • Instruction Fuzzy Hash: 0701D67291C20396F770AF60A46227E73A0EF44708FA8147AD54DC2695DF3DE546CB54
                                    Function 00007FFE013B4090 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: _handle_errorf_raise_excf
                                    • String ID: !$cosf
                                    • API String ID: 3848079588-2208875612
                                    • Opcode ID: 26b774126baaf243e6bc53b960026d5df92d452ba4082686f3f634491a9e9896
                                    • Instruction ID: 97f955a04badb7fc28d4aa894257332770d1e180c5e2d1bd443086b785bcc93f
                                    • Opcode Fuzzy Hash: 26b774126baaf243e6bc53b960026d5df92d452ba4082686f3f634491a9e9896
                                    • Instruction Fuzzy Hash: 2401B972E1C65187F314CB2AE48036AB5A1FBE4784F714225F7450AAB9DB7CD1815F04
                                    Function 00007FFE013B40B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: _handle_error_raise_exc
                                    • String ID: !$sin
                                    • API String ID: 1935476177-1565623160
                                    • Opcode ID: 62574e8540d24f84c87472f104277cb576fe087112787b180d5915e614e9f115
                                    • Instruction ID: 6db2dc3ca0c9c06c921e9383036e006dfa6b791f4dca34f8f7c208fccd87d6aa
                                    • Opcode Fuzzy Hash: 62574e8540d24f84c87472f104277cb576fe087112787b180d5915e614e9f115
                                    • Instruction Fuzzy Hash: F8018871E18B8582D714CF22A8803766161BFDA7D4F504335EA5E1BB95EF7CD1415B04
                                    Function 00007FFE013AF8C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: _handle_errorf
                                    • String ID: "$expf
                                    • API String ID: 2315412904-303238936
                                    • Opcode ID: c25ccdf68e813efd17a07b6cce32e1116de40518e53c6b29da4ebfe3fe30e03f
                                    • Instruction ID: 0e98f6507da0d459410ad74cbb7c8dd4421a95b56ec1d56351b0f3114c234076
                                    • Opcode Fuzzy Hash: c25ccdf68e813efd17a07b6cce32e1116de40518e53c6b29da4ebfe3fe30e03f
                                    • Instruction Fuzzy Hash: 810156729286C497D330CB21D4457AAB660FFE5344F905319E784166B4DF7DD495AF00
                                    Function 00007FFE013B4200 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: _handle_errorf_raise_excf
                                    • String ID: !$sinf
                                    • API String ID: 3848079588-676365165
                                    • Opcode ID: 96c8438363064ea2871ce68c63b096ee2a125b1042229195728392d85c0a1e2a
                                    • Instruction ID: d3a2f3412661c54d522238961102f431bf990064c654a573c348ce6938ee6ec3
                                    • Opcode Fuzzy Hash: 96c8438363064ea2871ce68c63b096ee2a125b1042229195728392d85c0a1e2a
                                    • Instruction Fuzzy Hash: 1B01D472E1C68183F310CB26E88036AB6A1FBE4784F704324E7490AAB9DF7CD0809F04
                                    Function 00007FFE013B4240 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: _handle_errorf_raise_excf
                                    • String ID: !$tanf
                                    • API String ID: 3848079588-3147098732
                                    • Opcode ID: 7dea2b079d508d96e5b7d407b91a86e8908217ad4ab7312aa947a5f7f4c85213
                                    • Instruction ID: 684c99ccbd3c12fbd99fa3c0564e75b8a4e252dd113ea03b78fafb15fa1cfaa6
                                    • Opcode Fuzzy Hash: 7dea2b079d508d96e5b7d407b91a86e8908217ad4ab7312aa947a5f7f4c85213
                                    • Instruction Fuzzy Hash: F9018472E1C68187F314CB26E88136AB6A1FBE5784F704325E7490AAB9DB7CD5819F04
                                    Function 00007FFE013AF820 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: _handle_error
                                    • String ID: "$exp
                                    • API String ID: 1757819995-2878093337
                                    • Opcode ID: 0a5b4b2791ad97c1fb4e84ea0ca9bfa908e42d49a1b3a39517376e4252d0e70a
                                    • Instruction ID: a11d3fede8214d7b1f4c3dd62ca48ff59e1a0407532ee721b6aadbceb2aced45
                                    • Opcode Fuzzy Hash: 0a5b4b2791ad97c1fb4e84ea0ca9bfa908e42d49a1b3a39517376e4252d0e70a
                                    • Instruction Fuzzy Hash: 37018436D28B9887E720CF24D4492AE7BB1FFEA744F641315E7442A670CB7DD4859B00
                                    Function 00007FFE13278140 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692291900.00007FFE13271000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFE13270000, based on PE: true
                                    • Associated: 00000002.00000002.1692276597.00007FFE13270000.00000002.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13281000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13283000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13286000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692354101.00007FFE13287000.00000080.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692369518.00007FFE13288000.00000004.00000001.01000000.00000007.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13270000_run0796.jbxd
                                    Similarity
                                    • API ID: if_nametoindex
                                    • String ID: O&:if_nametoindex$no interface with this name
                                    • API String ID: 3183282855-3835682882
                                    • Opcode ID: 2ab6b64bff9d2b892d881fe9f08b6323cb6d2d50f3a21e32f60e21339ada057f
                                    • Instruction ID: 3f1420c9921b8a7bea972781dce380ee3b9328c1ccfb1415f97dca37a6473d6d
                                    • Opcode Fuzzy Hash: 2ab6b64bff9d2b892d881fe9f08b6323cb6d2d50f3a21e32f60e21339ada057f
                                    • Instruction Fuzzy Hash: 8101E870B08F428AEA10BB27E8950792770BFF9F68F5404B5DA4E66674DE7CE504C710
                                    Function 00007FFE13277BFC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692291900.00007FFE13271000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFE13270000, based on PE: true
                                    • Associated: 00000002.00000002.1692276597.00007FFE13270000.00000002.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13281000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13283000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13286000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692354101.00007FFE13287000.00000080.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692369518.00007FFE13288000.00000004.00000001.01000000.00000007.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13270000_run0796.jbxd
                                    Similarity
                                    • API ID: getprotobyname
                                    • String ID: protocol not found$s:getprotobyname
                                    • API String ID: 402843736-630402058
                                    • Opcode ID: c71a71efda0356e1d774585c53ee7afc9774e87fcc9d592355ba6f2c983bde5d
                                    • Instruction ID: 3ea33b27db83ae49ef19fbf3746886cd30f85ba03d3037fc50e9c8f0edabc414
                                    • Opcode Fuzzy Hash: c71a71efda0356e1d774585c53ee7afc9774e87fcc9d592355ba6f2c983bde5d
                                    • Instruction Fuzzy Hash: 93010475B18F428AEA14AB27E99407963B0FFF9BE5F4400B5DA4E67A34DE2CE054C700
                                    Function 00007FFE13278240 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692291900.00007FFE13271000.00000040.00000001.01000000.00000007.sdmp, Offset: 00007FFE13270000, based on PE: true
                                    • Associated: 00000002.00000002.1692276597.00007FFE13270000.00000002.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13281000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13283000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692291900.00007FFE13286000.00000040.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692354101.00007FFE13287000.00000080.00000001.01000000.00000007.sdmpDownload File
                                    • Associated: 00000002.00000002.1692369518.00007FFE13288000.00000004.00000001.01000000.00000007.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe13270000_run0796.jbxd
                                    Similarity
                                    • API ID: inet_ntoa
                                    • String ID: packed IP wrong length for inet_ntoa$y*:inet_ntoa
                                    • API String ID: 1879540557-3027498899
                                    • Opcode ID: 7daa6f1744a3d0a75287305b6be245906bfaeac108ce3fe86f9020a565bdced7
                                    • Instruction ID: dbe0afcedf40372aa1eaf194ad7dfd83e6becf652b90aece73171cd6f477feef
                                    • Opcode Fuzzy Hash: 7daa6f1744a3d0a75287305b6be245906bfaeac108ce3fe86f9020a565bdced7
                                    • Instruction Fuzzy Hash: 6101DA35B08F478ADA10AB26E8580692370FBF9B59B5401B5D68E63674DE3CD509C700
                                    Function 00007FFE013C21A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • try_get_function.LIBVCRUNTIME ref: 00007FFE013C21C9
                                    • TlsSetValue.API-MS-WIN-CORE-PROCESSTHREADS-L1-1-0(?,?,00000000,00007FFE013C1BE1,?,?,?,?,00007FFE013C1A3D,?,?,?,?,00007FFE01388ACC), ref: 00007FFE013C21E0
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID: Valuetry_get_function
                                    • String ID: FlsSetValue
                                    • API String ID: 738293619-3750699315
                                    • Opcode ID: 612b9a4b753447088afa87767267f8aa2290b8aefb7273a0d5797a0a9381a075
                                    • Instruction ID: 8aca8c862509d497ab04d1b325f83b4e249593feb1b8ca6d966ed3c3b4980634
                                    • Opcode Fuzzy Hash: 612b9a4b753447088afa87767267f8aa2290b8aefb7273a0d5797a0a9381a075
                                    • Instruction Fuzzy Hash: 58E06D65A0868282FB085B55FC041B92262EF887C0F894032DA4D0E2B5CE3CE948C710
                                    Function 00007FFE0138AD20 Relevance: 5.2, APIs: 4, Instructions: 196COMMONLIBRARYCODE
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000002.00000002.1692148435.00007FFE01381000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FFE01380000, based on PE: true
                                    • Associated: 00000002.00000002.1692131277.00007FFE01380000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692212836.00007FFE01431000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692240853.00007FFE01469000.00000004.00000001.01000000.00000004.sdmpDownload File
                                    • Associated: 00000002.00000002.1692258780.00007FFE0146C000.00000002.00000001.01000000.00000004.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_2_2_7ffe01380000_run0796.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 79d76f31d62366e6e35a10628089bc0c69e54cc1b0187099d9002e0f5e05de5c
                                    • Instruction ID: 8b11d801b86b506a7695348df0d28aa66cdabe28806831f6e853b75d9a3ce69b
                                    • Opcode Fuzzy Hash: 79d76f31d62366e6e35a10628089bc0c69e54cc1b0187099d9002e0f5e05de5c
                                    • Instruction Fuzzy Hash: D681A462A0C78286EB619B64A44027EB7E0FF417A0F155236EEAD4B6F5DF3CE495C700