Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
xSO7sbN2j6.exe

Overview

General Information

Sample name:xSO7sbN2j6.exe
(renamed file extension from none to exe, renamed because original name is a hash value)
Original sample name:95256b28dfb85f1d5bafdec109950775733d4af82acc0512151639695c57e469
Analysis ID:1428491
MD5:5917c8e5a003b2c211150d1f92440f79
SHA1:fc3dfd511d75828c56aec3be55931d42bfbdd96e
SHA256:95256b28dfb85f1d5bafdec109950775733d4af82acc0512151639695c57e469
Infos:

Detection

Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Found pyInstaller with non standard icon
Queries BIOS fan information (via WMI, Win32_Fan, often done to detect virtual machines)
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Queries temperature or sensor information (via WMI often done to detect virtual machines)
Queries voltage information (via WMI often done to detect virtual machines)
Tries to detect virtualization through RDTSC time measurements
Binary contains a suspicious time stamp
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to detect virtual machines (SGDT)
Contains functionality to detect virtual machines (SIDT)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • xSO7sbN2j6.exe (PID: 1268 cmdline: "C:\Users\user\Desktop\xSO7sbN2j6.exe" MD5: 5917C8E5A003B2C211150D1F92440F79)
    • conhost.exe (PID: 3576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • xSO7sbN2j6.exe (PID: 3424 cmdline: "C:\Users\user\Desktop\xSO7sbN2j6.exe" MD5: 5917C8E5A003B2C211150D1F92440F79)
      • netconn_properties.exe (PID: 1352 cmdline: C:\Users\user\AppData\Local\Temp\_MEI12682\exe/netconn_properties.exe MD5: 3B8E84142573A5E30990BDE2E574C447)
      • registers.exe (PID: 5784 cmdline: C:\Users\user\AppData\Local\Temp\_MEI12682\exe/registers.exe MD5: 527010682A02EE5935BAC5B2D074C49D)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: xSO7sbN2j6.exeReversingLabs: Detection: 15%
Source: xSO7sbN2j6.exeVirustotal: Detection: 16%Perma Link
Source: xSO7sbN2j6.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2239037297.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-locale-l1-1-0.dll.1.dr
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-3.8\Release\win32net.pdb source: xSO7sbN2j6.exe, 00000003.00000002.2444861222.00007FF8B61C1000.00000040.00000001.01000000.00000014.sdmp
Source: Binary string: C:\Users\c\source\repos\ConsoleApplication2\Release\ConsoleApplication2.pdb source: registers.exe, registers.exe, 0000000A.00000002.2415695027.0000000000261000.00000040.00000001.01000000.00000022.sdmp
Source: Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2239773442.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-runtime-l1-1-0.dll.1.dr
Source: Binary string: C:\A\34\b\bin\amd64\select.pdb source: xSO7sbN2j6.exe, 00000003.00000002.2447521757.00007FF8B9841000.00000040.00000001.01000000.00000012.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_A source: xSO7sbN2j6.exe
Source: Binary string: api-ms-win-core-file-l1-2-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2232435962.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.1.dr
Source: Binary string: ucrtbase.pdb source: xSO7sbN2j6.exe, 00000003.00000002.2445898778.00007FF8B80D5000.00000002.00000001.01000000.00000004.sdmp, ucrtbase.dll.1.dr
Source: Binary string: api-ms-win-core-memory-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2233416251.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-memory-l1-1-0.dll.1.dr
Source: Binary string: api-ms-win-core-debug-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2232106594.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-debug-l1-1-0.dll.1.dr
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-3.8\Release\pywintypes.pdb source: xSO7sbN2j6.exe, 00000003.00000002.2445592803.00007FF8B7FF1000.00000040.00000001.01000000.0000000C.sdmp
Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2234782736.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.1.dr
Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2237358262.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\A\34\b\bin\amd64\python38.pdb source: xSO7sbN2j6.exe, 00000003.00000002.2443034874.00007FF8A8CCC000.00000040.00000001.01000000.00000005.sdmp
Source: Binary string: C:\Users\c\source\repos\ConsoleApplication2\Release\ConsoleApplication2.pdb%% source: registers.exe, 0000000A.00000002.2415695027.0000000000261000.00000040.00000001.01000000.00000022.sdmp
Source: Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2239861973.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-3.8\Release\win32security.pdb source: xSO7sbN2j6.exe, 00000003.00000002.2444589477.00007FF8B6191000.00000040.00000001.01000000.00000015.sdmp
Source: Binary string: api-ms-win-core-heap-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2232822044.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\A\34\b\bin\amd64\python3.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2242717820.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2448608318.00007FF8BA4F2000.00000002.00000001.01000000.00000007.sdmp, python3.dll.1.dr
Source: Binary string: api-ms-win-core-util-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2235784465.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-synch-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2234547266.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-synch-l1-1-0.dll.1.dr
Source: Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2236972106.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-environment-l1-1-0.dll.1.dr
Source: Binary string: C:\A\34\b\bin\amd64\_ssl.pdb source: xSO7sbN2j6.exe, 00000003.00000002.2444067430.00007FF8B5711000.00000040.00000001.01000000.00000018.sdmp
Source: Binary string: D:\a01\_work\26\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2230257256.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2448737746.00007FF8BFAD1000.00000002.00000001.01000000.00000006.sdmp, VCRUNTIME140.dll.1.dr
Source: Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2232218108.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-errorhandling-l1-1-0.dll.1.dr
Source: Binary string: d:\a01\_work\12\s\\binaries\amd64ret\bin\amd64\\mfc140u.amd64.pdb source: mfc140u.dll.1.dr
Source: Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2233738349.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-0.dll.1.dr
Source: Binary string: d:\a01\_work\12\s\\binaries\amd64ret\bin\amd64\\mfc140u.amd64.pdbGCTL source: mfc140u.dll.1.dr
Source: Binary string: api-ms-win-core-console-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2231807921.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.1.dr
Source: Binary string: api-ms-win-core-file-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2232341692.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-1-0.dll.1.dr
Source: Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2236165439.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\A\6\b\libssl-1_1.pdb source: xSO7sbN2j6.exe, xSO7sbN2j6.exe, 00000003.00000002.2442460559.00007FF8A88B4000.00000040.00000001.01000000.00000019.sdmp
Source: Binary string: C:\Users\b\source\repos\ConsoleApplication1\Release\ConsoleApplication1.pdb source: netconn_properties.exe, netconn_properties.exe, 00000007.00000002.2414728783.0000000000A01000.00000040.00000001.01000000.00000021.sdmp
Source: Binary string: api-ms-win-core-profile-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2234146122.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.1.dr
Source: Binary string: ucrtbase.pdbUGP source: xSO7sbN2j6.exe, 00000003.00000002.2445898778.00007FF8B80D5000.00000002.00000001.01000000.00000004.sdmp, ucrtbase.dll.1.dr
Source: Binary string: C:\A\34\b\bin\amd64\unicodedata.pdb source: xSO7sbN2j6.exe, 00000003.00000002.2441062409.00007FF8A8195000.00000040.00000001.01000000.0000001E.sdmp
Source: Binary string: api-ms-win-crt-time-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2240170760.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a01\_work\26\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2230430431.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2447867332.00007FF8B9F65000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-3.8\Release\pythoncom.pdb}},GCTL source: xSO7sbN2j6.exe, 00000003.00000002.2442766857.00007FF8A8901000.00000040.00000001.01000000.0000000E.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\msvcp140.amd64.pdb source: MSVCP140.dll.1.dr
Source: Binary string: api-ms-win-core-handle-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2232671264.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\A\34\b\bin\amd64\_bz2.pdb source: xSO7sbN2j6.exe, 00000003.00000002.2447332028.00007FF8B93C1000.00000040.00000001.01000000.0000000A.sdmp
Source: Binary string: C:\A\34\b\bin\amd64\_lzma.pdbMM source: xSO7sbN2j6.exe, 00000003.00000002.2446708944.00007FF8B8F8D000.00000040.00000001.01000000.0000000B.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-3.8\Release\pywintypes.pdb** source: xSO7sbN2j6.exe, 00000003.00000002.2445592803.00007FF8B7FF1000.00000040.00000001.01000000.0000000C.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\msvcp140.amd64.pdbGCTL source: MSVCP140.dll.1.dr
Source: Binary string: api-ms-win-core-synch-l1-2-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2234634320.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-synch-l1-2-0.dll.1.dr
Source: Binary string: C:\A\34\b\bin\amd64\_hashlib.pdb source: xSO7sbN2j6.exe, 00000003.00000002.2444302392.00007FF8B6176000.00000040.00000001.01000000.00000016.sdmp
Source: Binary string: C:\A\6\b\libssl-1_1.pdb?? source: xSO7sbN2j6.exe, 00000003.00000002.2442460559.00007FF8A88B4000.00000040.00000001.01000000.00000019.sdmp
Source: Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2233634128.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processenvironment-l1-1-0.dll.1.dr
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: xSO7sbN2j6.exe, 00000003.00000002.2441450814.00007FF8A83F8000.00000040.00000001.01000000.00000017.sdmp
Source: Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2231902757.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-3.8\Release\win32net.pdb source: xSO7sbN2j6.exe, 00000003.00000002.2444861222.00007FF8B61C1000.00000040.00000001.01000000.00000014.sdmp
Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2235950959.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-conio-l1-1-0.dll.1.dr
Source: Binary string: C:\A\34\b\bin\amd64\_socket.pdb source: xSO7sbN2j6.exe, 00000003.00000002.2446080851.00007FF8B8251000.00000040.00000001.01000000.00000011.sdmp
Source: Binary string: api-ms-win-core-localization-l1-2-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2233290847.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.1.dr
Source: Binary string: api-ms-win-crt-math-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2239258092.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\A\34\b\bin\amd64\_ctypes.pdb source: xSO7sbN2j6.exe, 00000003.00000002.2447129812.00007FF8B90E1000.00000040.00000001.01000000.00000008.sdmp
Source: Binary string: C:\A\34\b\bin\amd64\_lzma.pdb source: xSO7sbN2j6.exe, 00000003.00000002.2446708944.00007FF8B8F8D000.00000040.00000001.01000000.0000000B.sdmp
Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2233871695.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.1.dr
Source: Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2233543724.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-namedpipe-l1-1-0.dll.1.dr
Source: Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2239479830.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-multibyte-l1-1-0.dll.1.dr
Source: Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2240443886.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2234300243.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2235634596.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-timezone-l1-1-0.dll.1.dr
Source: Binary string: api-ms-win-core-string-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2234396719.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-file-l2-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2232552994.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-process-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2239664904.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-process-l1-1-0.dll.1.dr
Source: Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2233028833.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-3.8\Release\pythoncom.pdb source: xSO7sbN2j6.exe, xSO7sbN2j6.exe, 00000003.00000002.2442766857.00007FF8A8901000.00000040.00000001.01000000.0000000E.sdmp
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1k 25 Mar 2021built on: Tue Apr 6 11:26:02 2021 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: xSO7sbN2j6.exe, 00000003.00000002.2441450814.00007FF8A83F8000.00000040.00000001.01000000.00000017.sdmp
Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2232918955.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\A\34\b\bin\amd64\_queue.pdb source: xSO7sbN2j6.exe, 00000003.00000002.2446511663.00007FF8B8CB1000.00000040.00000001.01000000.0000001B.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-3.8\Release\win32api.pdb source: xSO7sbN2j6.exe, 00000003.00000002.2445139659.00007FF8B78A1000.00000040.00000001.01000000.0000000F.sdmp
Source: Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2238777336.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-heap-l1-1-0.dll.1.dr
Source: Binary string: api-ms-win-crt-string-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2239987749.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-string-l1-1-0.dll.1.dr
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-3.8\Release\win32api.pdb!! source: xSO7sbN2j6.exe, 00000003.00000002.2445139659.00007FF8B78A1000.00000040.00000001.01000000.0000000F.sdmp
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7B6878 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,1_2_00007FF73D7B6878
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7A69E0 FindFirstFileExW,FindClose,1_2_00007FF73D7A69E0
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7C0A34 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,1_2_00007FF73D7C0A34
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7B6878 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,1_2_00007FF73D7B6878
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7B6878 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,3_2_00007FF73D7B6878
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7C0A34 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,3_2_00007FF73D7C0A34
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7B6878 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,3_2_00007FF73D7B6878
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7A69E0 FindFirstFileExW,FindClose,3_2_00007FF73D7A69E0
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B4480 MultiByteToWideChar,GetLastError,MultiByteToWideChar,MultiByteToWideChar,00007FF8C610F020,FindFirstFileW,FindNextFileW,WideCharToMultiByte,3_2_00007FF8A81B4480
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\netconn_properties.exeCode function: 7_2_00A0CD11 FindFirstFileExW,7_2_00A0CD11
Source: xSO7sbN2j6.exe, 00000003.00000002.2439755385.0000021030E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://.../back.jpeg
Source: xSO7sbN2j6.exe, 00000003.00000002.2436948556.0000021030270000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://193.17.183.14:3000/
Source: xSO7sbN2j6.exe, 00000003.00000003.2254594450.000002102E6DF000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2435457331.000002102E6DF000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2432907096.000002102E6DF000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2431258852.000002102E6DF000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2422307122.000002102E6DF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://193.17.183.14:3000/)
Source: xSO7sbN2j6.exe, 00000001.00000003.2230935199.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231419814.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242231546.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2243884643.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231219931.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242552349.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230779110.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2244516546.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2241515410.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231615557.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242943794.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242054897.000001EB0964A000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242717820.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230655896.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230534838.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242054897.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231035454.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231219931.000001EB09649000.00000004.00000020.00020000.00000000.sdmp, python3.dll.1.dr, libssl-1_1.dll.1.dr, unicodedata.pyd.1.drString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: xSO7sbN2j6.exe, 00000001.00000003.2242717820.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231219931.000001EB09649000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2Assure
Source: xSO7sbN2j6.exe, 00000001.00000003.2230935199.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231419814.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242231546.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2243884643.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231219931.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242552349.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230779110.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2244516546.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2241515410.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231615557.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242943794.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242054897.000001EB0964A000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242717820.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230655896.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230534838.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242054897.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231035454.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, python3.dll.1.dr, libssl-1_1.dll.1.dr, unicodedata.pyd.1.dr, _ssl.pyd.1.drString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: xSO7sbN2j6.exe, 00000001.00000003.2230935199.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231419814.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242231546.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2243884643.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231219931.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242552349.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230779110.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2244516546.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2241515410.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231615557.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242943794.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242717820.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230655896.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230534838.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231035454.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, python3.dll.1.dr, libssl-1_1.dll.1.dr, unicodedata.pyd.1.dr, _ssl.pyd.1.dr, _lzma.pyd.1.dr, pyexpat.pyd.1.drString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: xSO7sbN2j6.exe, 00000001.00000003.2242054897.000001EB0963D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: xSO7sbN2j6.exe, 00000001.00000003.2230534838.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiC
Source: xSO7sbN2j6.exe, 00000001.00000003.2230534838.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCM
Source: xSO7sbN2j6.exe, 00000001.00000003.2230935199.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231419814.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242231546.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2243884643.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231219931.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242552349.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230779110.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2244516546.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2241515410.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231615557.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242943794.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242054897.000001EB0964A000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242717820.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230655896.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242054897.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231035454.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, python3.dll.1.dr, libssl-1_1.dll.1.dr, unicodedata.pyd.1.dr, _ssl.pyd.1.dr, _lzma.pyd.1.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: xSO7sbN2j6.exe, 00000001.00000003.2230935199.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231419814.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242231546.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2243884643.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231219931.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242552349.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230779110.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2244516546.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2241515410.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231615557.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242943794.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242717820.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230655896.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230534838.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231035454.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231219931.000001EB09649000.00000004.00000020.00020000.00000000.sdmp, python3.dll.1.dr, libssl-1_1.dll.1.dr, unicodedata.pyd.1.dr, _ssl.pyd.1.dr, _lzma.pyd.1.drString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: xSO7sbN2j6.exe, 00000001.00000003.2230935199.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231419814.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242231546.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2243884643.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231219931.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242552349.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230779110.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2244516546.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2241515410.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231615557.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242943794.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242054897.000001EB0964A000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242717820.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230655896.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230534838.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242054897.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231035454.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, python3.dll.1.dr, libssl-1_1.dll.1.dr, unicodedata.pyd.1.dr, _ssl.pyd.1.drString found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: xSO7sbN2j6.exe, 00000001.00000003.2230935199.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231419814.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242231546.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2243884643.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231219931.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242552349.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230779110.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2244516546.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2241515410.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231615557.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242943794.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242717820.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230655896.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230534838.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231035454.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231219931.000001EB09649000.00000004.00000020.00020000.00000000.sdmp, python3.dll.1.dr, libssl-1_1.dll.1.dr, unicodedata.pyd.1.dr, _ssl.pyd.1.dr, _lzma.pyd.1.drString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: xSO7sbN2j6.exe, 00000001.00000003.2230935199.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231419814.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242231546.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2243884643.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231219931.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242552349.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230779110.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2244516546.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2241515410.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231615557.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242943794.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242054897.000001EB0964A000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242717820.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230655896.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230534838.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242054897.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231035454.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231219931.000001EB09649000.00000004.00000020.00020000.00000000.sdmp, python3.dll.1.dr, libssl-1_1.dll.1.dr, unicodedata.pyd.1.drString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: xSO7sbN2j6.exe, 00000001.00000003.2230935199.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231419814.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242231546.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2243884643.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231219931.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242552349.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230779110.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2244516546.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2241515410.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231615557.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242943794.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242054897.000001EB0964A000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242717820.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230655896.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230534838.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242054897.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231035454.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, python3.dll.1.dr, libssl-1_1.dll.1.dr, unicodedata.pyd.1.dr, _ssl.pyd.1.drString found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: xSO7sbN2j6.exe, 00000001.00000003.2230935199.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231419814.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242231546.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2243884643.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231219931.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242552349.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230779110.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2244516546.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2241515410.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231615557.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242943794.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242717820.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230655896.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230534838.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231035454.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231219931.000001EB09649000.00000004.00000020.00020000.00000000.sdmp, python3.dll.1.dr, libssl-1_1.dll.1.dr, unicodedata.pyd.1.dr, _ssl.pyd.1.dr, _lzma.pyd.1.drString found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: xSO7sbN2j6.exe, 00000003.00000002.2439755385.0000021030E90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: xSO7sbN2j6.exe, 00000003.00000002.2437139354.0000021030370000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://goo.gl/zeJZl
Source: xSO7sbN2j6.exe, 00000003.00000003.2423714607.000002103020C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2422096808.00000210301C9000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2423197574.00000210301C9000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2436577050.0000021030211000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2431934560.000002103020D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2426840147.000002103021A000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2433468001.000002103020E000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2433810897.0000021030210000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/
Source: xSO7sbN2j6.exe, 00000003.00000003.2423625603.0000021030163000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2427750884.0000021030164000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2423437104.0000021030111000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2422434748.0000021030111000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://google.com/mail/
Source: xSO7sbN2j6.exe, 00000003.00000003.2426690756.00000210300F3000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2431068921.00000210300FB000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2422434748.0000021030084000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2423437104.0000021030085000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535
Source: xSO7sbN2j6.exe, 00000003.00000003.2254594450.000002102E62E000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2433190982.0000021030082000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2422434748.0000021030084000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2432907096.000002102E6DF000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2431258852.000002102E6DF000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2422307122.000002102E6DF000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2428983620.0000021030085000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2423437104.0000021030085000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2433913042.0000021030089000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2422597636.000002103007F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2431770423.0000021030086000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://json.org
Source: xSO7sbN2j6.exe, 00000003.00000002.2437083752.0000021030330000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://mail.python.org/pipermail/python-dev/2012-June/120787.html
Source: xSO7sbN2j6.exe, 00000001.00000003.2230935199.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231419814.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242231546.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2243884643.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231219931.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242552349.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230779110.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2244516546.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2241515410.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231615557.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242943794.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242054897.000001EB0964A000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242717820.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230655896.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230534838.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242054897.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231035454.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231219931.000001EB09649000.00000004.00000020.00020000.00000000.sdmp, python3.dll.1.dr, libssl-1_1.dll.1.dr, unicodedata.pyd.1.drString found in binary or memory: http://ocsp.digicert.com0C
Source: xSO7sbN2j6.exe, 00000001.00000003.2230935199.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231419814.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242231546.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2243884643.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231219931.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242552349.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230779110.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2244516546.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2241515410.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231615557.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242943794.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242054897.000001EB0964A000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242717820.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230655896.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230534838.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242054897.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231035454.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, python3.dll.1.dr, libssl-1_1.dll.1.dr, unicodedata.pyd.1.dr, _ssl.pyd.1.drString found in binary or memory: http://ocsp.digicert.com0N
Source: xSO7sbN2j6.exe, 00000001.00000003.2230935199.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231419814.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242231546.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2243884643.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231219931.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242552349.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230779110.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2244516546.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2241515410.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231615557.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242943794.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242717820.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230655896.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230534838.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231035454.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231219931.000001EB09649000.00000004.00000020.00020000.00000000.sdmp, python3.dll.1.dr, libssl-1_1.dll.1.dr, unicodedata.pyd.1.dr, _ssl.pyd.1.dr, _lzma.pyd.1.drString found in binary or memory: http://ocsp.digicert.com0O
Source: xSO7sbN2j6.exe, 00000001.00000003.2242054897.000001EB0963D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.thawte.com0
Source: xSO7sbN2j6.exe, 00000003.00000002.2443034874.00007FF8A8CCC000.00000040.00000001.01000000.00000005.sdmpString found in binary or memory: http://python.org/dev/peps/pep-0263/
Source: xSO7sbN2j6.exe, 00000003.00000002.2436948556.0000021030270000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://timgolden.me.uk/python/wmi.html
Source: xSO7sbN2j6.exe, 00000003.00000002.2439623686.0000021030DC0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: xSO7sbN2j6.exe, 00000001.00000003.2242054897.000001EB0963D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: xSO7sbN2j6.exe, 00000001.00000003.2242054897.000001EB0963D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: xSO7sbN2j6.exe, 00000001.00000003.2242054897.000001EB0963D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: xSO7sbN2j6.exe, 00000003.00000002.2435883667.0000021030070000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
Source: xSO7sbN2j6.exe, 00000001.00000003.2230935199.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231419814.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242231546.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2243884643.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231219931.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242552349.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230779110.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2244516546.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2241515410.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231615557.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242943794.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242717820.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230655896.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230534838.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231035454.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231219931.000001EB09649000.00000004.00000020.00020000.00000000.sdmp, python3.dll.1.dr, libssl-1_1.dll.1.dr, unicodedata.pyd.1.dr, _ssl.pyd.1.dr, _lzma.pyd.1.drString found in binary or memory: http://www.digicert.com/CPS0
Source: xSO7sbN2j6.exe, 00000003.00000003.2423714607.000002103020C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2422096808.00000210301C9000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2423197574.00000210301C9000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2436577050.0000021030211000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2431934560.000002103020D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2433468001.000002103020E000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2433810897.0000021030210000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: xSO7sbN2j6.exe, 00000003.00000002.2435883667.0000021030070000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
Source: xSO7sbN2j6.exe, 00000003.00000002.2435832830.0000021030030000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.ntcore.com/files/richsign.htm
Source: xSO7sbN2j6.exe, 00000003.00000002.2435832830.0000021030030000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: xSO7sbN2j6.exe, 00000003.00000003.2427260813.00000210306C3000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2420272100.00000210306B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.python.org/
Source: xSO7sbN2j6.exe, 00000001.00000003.2246060805.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2435780956.000002102FFF0000.00000004.00001000.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2254594450.000002102E62E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.python.org/dev/peps/pep-0205/
Source: xSO7sbN2j6.exe, 00000003.00000002.2435047798.000002102DFB0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.python.org/download/releases/2.3/mro/.
Source: xSO7sbN2j6.exe, 00000003.00000003.2427260813.00000210306C3000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2437767537.00000210306C4000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2420272100.00000210306B1000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2430312247.00000210306C4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wwwsearch.sf.net/):
Source: xSO7sbN2j6.exe, 00000003.00000002.2437313978.0000021030500000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://auscitte.github.io/systems%20blog/Exception-Directory-pefile#implementation-details
Source: xSO7sbN2j6.exe, 00000003.00000002.2439890285.0000021030F80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/socket.html#socket.socket.connect_ex
Source: xSO7sbN2j6.exe, 00000003.00000002.2439352613.0000021030C20000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://foss.heptapod.net/pypy/pypy/-/issues/3539
Source: xSO7sbN2j6.exe, 00000003.00000003.2422096808.00000210301C9000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2425207464.0000021030208000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2423197574.00000210301C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Ousret/charset_normalizer
Source: xSO7sbN2j6.exe, 00000003.00000003.2428147875.000002102E61C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2251857001.000002102DE12000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2431983853.000002102DE25000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2251711442.000002102DE23000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2435267835.000002102E620000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2252362356.000002102DE12000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2434678392.000002102DE25000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2429262032.000002102DE24000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2429012313.000002102DE17000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2251408429.000002102DE12000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2252165282.000002102DE23000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2428839810.000002102DE12000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2422739995.000002102DE12000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: xSO7sbN2j6.exe, 00000003.00000002.2437139354.0000021030370000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/giampaolo/psutil/issues/875.
Source: xSO7sbN2j6.exe, 00000001.00000003.2245348776.000001EB0964B000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2243434894.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2245250027.000001EB0964B000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2244843348.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2245348776.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2245250027.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2244989268.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2243739150.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2244711265.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2244711265.000001EB0964B000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2229733855.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2245110481.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2445756170.00007FF8B801B000.00000004.00000001.01000000.0000000C.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2445273022.00007FF8B78CB000.00000004.00000001.01000000.0000000F.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2445053706.00007FF8B61E1000.00000004.00000001.01000000.00000014.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2444783479.00007FF8B61BE000.00000004.00000001.01000000.00000015.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2442979393.00007FF8A89BD000.00000004.00000001.01000000.0000000E.sdmp, win32security.pyd.1.dr, win32trace.pyd.1.dr, win32net.pyd.1.dr, win32api.pyd.1.drString found in binary or memory: https://github.com/mhammond/pywin32
Source: xSO7sbN2j6.exe, 00000003.00000002.2434833250.000002102DE70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: xSO7sbN2j6.exe, 00000003.00000003.2422739995.000002102DE12000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: xSO7sbN2j6.exe, 00000003.00000003.2428147875.000002102E61C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2251857001.000002102DE12000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2431983853.000002102DE25000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2251711442.000002102DE23000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2435267835.000002102E620000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2252362356.000002102DE12000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2434678392.000002102DE25000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2429262032.000002102DE24000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2429012313.000002102DE17000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2251408429.000002102DE12000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2252165282.000002102DE23000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2428839810.000002102DE12000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2422739995.000002102DE12000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: xSO7sbN2j6.exe, 00000003.00000003.2428147875.000002102E61C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2251857001.000002102DE12000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2431983853.000002102DE25000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2251711442.000002102DE23000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2435267835.000002102E620000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2252362356.000002102DE12000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2434678392.000002102DE25000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2429262032.000002102DE24000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2429012313.000002102DE17000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2251408429.000002102DE12000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2252165282.000002102DE23000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2428839810.000002102DE12000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2422739995.000002102DE12000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: xSO7sbN2j6.exe, 00000003.00000002.2439352613.0000021030C20000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
Source: xSO7sbN2j6.exe, 00000003.00000003.2423714607.000002103020C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2422096808.00000210301C9000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2423197574.00000210301C9000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2433838314.0000021030224000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2431674157.000002103021F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2436577050.0000021030225000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2426840147.000002103021A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.
Source: xSO7sbN2j6.exe, 00000003.00000002.2439623686.0000021030DC0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/2920
Source: xSO7sbN2j6.exe, 00000003.00000002.2439623686.0000021030DC0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/urllib3/urllib3/issues/29200
Source: xSO7sbN2j6.exe, 00000003.00000003.2423197574.00000210301C9000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2423367529.0000021030687000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2423290501.000002102E669000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2426840147.000002103021A000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2422877879.0000021030674000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2433603496.000002103068A000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2424521540.000002103068A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/
Source: xSO7sbN2j6.exe, 00000003.00000003.2423714607.000002103020C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2422096808.00000210301C9000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2423197574.00000210301C9000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2423367529.0000021030687000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2426840147.000002103021A000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2422877879.0000021030674000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2433603496.000002103068A000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2424521540.000002103068A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail
Source: xSO7sbN2j6.exe, 00000003.00000003.2422434748.0000021030111000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://google.com/mail/
Source: xSO7sbN2j6.exe, 00000003.00000003.2423714607.000002103020C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2422096808.00000210301C9000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2423197574.00000210301C9000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2431934560.000002103020D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://html.spec.whatwg.org/multipage/
Source: xSO7sbN2j6.exe, 00000003.00000003.2423290501.000002102E669000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/
Source: xSO7sbN2j6.exe, 00000003.00000003.2420272100.000002103071B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/get
Source: xSO7sbN2j6.exe, 00000003.00000003.2422877879.0000021030674000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/post
Source: xSO7sbN2j6.exe, 00000003.00000003.2427260813.00000210306C3000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2420272100.00000210306B1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mahler:8092/site-updates.py
Source: xSO7sbN2j6.exe, 00000003.00000003.2422877879.0000021030674000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2439890285.0000021030F80000.00000004.00001000.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2437590272.0000021030675000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://requests.readthedocs.io
Source: xSO7sbN2j6.exe, 00000003.00000002.2437139354.0000021030370000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/questions/4457745#4457745
Source: xSO7sbN2j6.exe, 00000003.00000003.2426690756.00000210300F3000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2431068921.00000210300FB000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2422434748.0000021030084000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2423437104.0000021030085000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2432380367.0000021030100000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc2388#section-4.4
Source: xSO7sbN2j6.exe, 00000003.00000003.2422096808.00000210301C9000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2425207464.0000021030208000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2423197574.00000210301C9000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2423290501.000002102E669000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/
Source: xSO7sbN2j6.exe, 00000001.00000003.2241172247.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, upx.exe.1.drString found in binary or memory: https://upx.github.ioT
Source: xSO7sbN2j6.exe, 00000003.00000002.2439623686.0000021030DC0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxy
Source: xSO7sbN2j6.exe, 00000003.00000002.2439438753.0000021030CA0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warnings
Source: xSO7sbN2j6.exe, 00000001.00000003.2230935199.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231419814.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242231546.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2243884643.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231219931.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242552349.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230779110.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2244516546.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2241515410.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231615557.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242943794.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242054897.000001EB0964A000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242717820.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230655896.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2230534838.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2242054897.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231035454.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2231219931.000001EB09649000.00000004.00000020.00020000.00000000.sdmp, python3.dll.1.dr, libssl-1_1.dll.1.dr, unicodedata.pyd.1.drString found in binary or memory: https://www.digicert.com/CPS0
Source: xSO7sbN2j6.exe, 00000003.00000002.2436994535.00000210302B0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.mandiant.com/resources/blog/tracking-malware-import-hashing
Source: xSO7sbN2j6.exe, 00000001.00000003.2242231546.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2442165063.00007FF8A84FE000.00000004.00000001.01000000.00000017.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2442708741.00007FF8A88F1000.00000004.00000001.01000000.00000019.sdmp, libssl-1_1.dll.1.drString found in binary or memory: https://www.openssl.org/H
Source: xSO7sbN2j6.exe, 00000003.00000003.2422877879.0000021030674000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org
Source: xSO7sbN2j6.exe, 00000003.00000003.2423714607.000002103020C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2422096808.00000210301C9000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2423197574.00000210301C9000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2423367529.0000021030687000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2426840147.000002103021A000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2422877879.0000021030674000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2433603496.000002103068A000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2424521540.000002103068A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://yahoo.com/
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7C4EA01_2_00007FF73D7C4EA0
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7C5DEC1_2_00007FF73D7C5DEC
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7A58E01_2_00007FF73D7A58E0
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7B68781_2_00007FF73D7B6878
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7B16C41_2_00007FF73D7B16C4
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7B66C41_2_00007FF73D7B66C4
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7C2DB01_2_00007FF73D7C2DB0
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7BFA881_2_00007FF73D7BFA88
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7B26141_2_00007FF73D7B2614
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7AFD401_2_00007FF73D7AFD40
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7B05601_2_00007FF73D7B0560
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7BCD641_2_00007FF73D7BCD64
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7C58A01_2_00007FF73D7C58A0
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7B70FC1_2_00007FF73D7B70FC
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7BD8781_2_00007FF73D7BD878
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7B4FC01_2_00007FF73D7B4FC0
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7AFF441_2_00007FF73D7AFF44
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7B07641_2_00007FF73D7B0764
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7B2A181_2_00007FF73D7B2A18
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7C0A341_2_00007FF73D7C0A34
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7C324C1_2_00007FF73D7C324C
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7BFA881_2_00007FF73D7BFA88
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7B68781_2_00007FF73D7B6878
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7B21DC1_2_00007FF73D7B21DC
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7BD1F81_2_00007FF73D7BD1F8
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7C511C1_2_00007FF73D7C511C
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7B01501_2_00007FF73D7B0150
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7B8D001_2_00007FF73D7B8D00
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7A74201_2_00007FF73D7A7420
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7C8BE81_2_00007FF73D7C8BE8
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7B132C1_2_00007FF73D7B132C
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7B03541_2_00007FF73D7B0354
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7C4EA03_2_00007FF73D7C4EA0
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7C5DEC3_2_00007FF73D7C5DEC
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7B21DC3_2_00007FF73D7B21DC
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7B132C3_2_00007FF73D7B132C
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7B16C43_2_00007FF73D7B16C4
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7B66C43_2_00007FF73D7B66C4
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7C2DB03_2_00007FF73D7C2DB0
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7BFA883_2_00007FF73D7BFA88
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7B26143_2_00007FF73D7B2614
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7AFD403_2_00007FF73D7AFD40
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7B05603_2_00007FF73D7B0560
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7BCD643_2_00007FF73D7BCD64
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7C58A03_2_00007FF73D7C58A0
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7A58E03_2_00007FF73D7A58E0
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7B70FC3_2_00007FF73D7B70FC
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7BD8783_2_00007FF73D7BD878
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7B68783_2_00007FF73D7B6878
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7B4FC03_2_00007FF73D7B4FC0
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7AFF443_2_00007FF73D7AFF44
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7B07643_2_00007FF73D7B0764
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7B2A183_2_00007FF73D7B2A18
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7C0A343_2_00007FF73D7C0A34
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7C324C3_2_00007FF73D7C324C
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7BFA883_2_00007FF73D7BFA88
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7B68783_2_00007FF73D7B6878
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7BD1F83_2_00007FF73D7BD1F8
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7C511C3_2_00007FF73D7C511C
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7B01503_2_00007FF73D7B0150
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7B8D003_2_00007FF73D7B8D00
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7A74203_2_00007FF73D7A7420
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7C8BE83_2_00007FF73D7C8BE8
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7B03543_2_00007FF73D7B0354
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A80912C03_2_00007FF8A80912C0
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A80918E03_2_00007FF8A80918E0
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A84FCDE03_2_00007FF8A84FCDE0
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B41473_2_00007FF8A81B4147
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B21213_2_00007FF8A81B2121
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A82E69B03_2_00007FF8A82E69B0
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A834EAF03_2_00007FF8A834EAF0
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B1AEB3_2_00007FF8A81B1AEB
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B1F823_2_00007FF8A81B1F82
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B6A233_2_00007FF8A81B6A23
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B65BE3_2_00007FF8A81B65BE
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A829AD303_2_00007FF8A829AD30
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B60283_2_00007FF8A81B6028
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B673F3_2_00007FF8A81B673F
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B12A83_2_00007FF8A81B12A8
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B61043_2_00007FF8A81B6104
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B3EBD3_2_00007FF8A81B3EBD
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81CEF003_2_00007FF8A81CEF00
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B26803_2_00007FF8A81B2680
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81CF0603_2_00007FF8A81CF060
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A82EF0903_2_00007FF8A82EF090
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B24373_2_00007FF8A81B2437
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A83661203_2_00007FF8A8366120
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A82E61A03_2_00007FF8A82E61A0
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B23513_2_00007FF8A81B2351
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B62583_2_00007FF8A81B6258
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B443F3_2_00007FF8A81B443F
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B30AD3_2_00007FF8A81B30AD
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B51F53_2_00007FF8A81B51F5
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B24B93_2_00007FF8A81B24B9
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B69423_2_00007FF8A81B6942
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B38003_2_00007FF8A81B3800
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B4DC23_2_00007FF8A81B4DC2
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B2B3F3_2_00007FF8A81B2B3F
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B19E23_2_00007FF8A81B19E2
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A82927B03_2_00007FF8A82927B0
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B105F3_2_00007FF8A81B105F
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B65733_2_00007FF8A81B6573
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B4E9E3_2_00007FF8A81B4E9E
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B3DD73_2_00007FF8A81B3DD7
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B283D3_2_00007FF8A81B283D
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B3C333_2_00007FF8A81B3C33
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A821FA003_2_00007FF8A821FA00
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B11DB3_2_00007FF8A81B11DB
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A834FC503_2_00007FF8A834FC50
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81CBD603_2_00007FF8A81CBD60
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B12C13_2_00007FF8A81B12C1
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B18933_2_00007FF8A81B1893
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B466F3_2_00007FF8A81B466F
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A82EFE503_2_00007FF8A82EFE50
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B1B9F3_2_00007FF8A81B1B9F
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B403E3_2_00007FF8A81B403E
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B1B7C3_2_00007FF8A81B1B7C
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81CBF203_2_00007FF8A81CBF20
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B201D3_2_00007FF8A81B201D
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B38783_2_00007FF8A81B3878
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A834C0503_2_00007FF8A834C050
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B135C3_2_00007FF8A81B135C
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B71C63_2_00007FF8A81B71C6
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B62A33_2_00007FF8A81B62A3
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B52273_2_00007FF8A81B5227
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A82DF1203_2_00007FF8A82DF120
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B51FA3_2_00007FF8A81B51FA
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B48EA3_2_00007FF8A81B48EA
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81CF2003_2_00007FF8A81CF200
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B1EBF3_2_00007FF8A81B1EBF
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B259A3_2_00007FF8A81B259A
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B2A3B3_2_00007FF8A81B2A3B
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B25223_2_00007FF8A81B2522
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B524A3_2_00007FF8A81B524A
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B60FF3_2_00007FF8A81B60FF
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81DB4C03_2_00007FF8A81DB4C0
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B1BD13_2_00007FF8A81B1BD1
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B4B923_2_00007FF8A81B4B92
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A834B6D03_2_00007FF8A834B6D0
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B5BB93_2_00007FF8A81B5BB9
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B3ECC3_2_00007FF8A81B3ECC
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B34C23_2_00007FF8A81B34C2
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81DB8503_2_00007FF8A81DB850
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A82DB8A03_2_00007FF8A82DB8A0
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B643D3_2_00007FF8A81B643D
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B381E3_2_00007FF8A81B381E
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B50383_2_00007FF8A81B5038
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B29413_2_00007FF8A81B2941
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A8350B703_2_00007FF8A8350B70
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B60AF3_2_00007FF8A81B60AF
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A83E8CF03_2_00007FF8A83E8CF0
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A82E4CE03_2_00007FF8A82E4CE0
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B65463_2_00007FF8A81B6546
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B63023_2_00007FF8A81B6302
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B2EC33_2_00007FF8A81B2EC3
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B6EAB3_2_00007FF8A81B6EAB
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B10413_2_00007FF8A81B1041
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B321A3_2_00007FF8A81B321A
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B60143_2_00007FF8A81B6014
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A82E4FF03_2_00007FF8A82E4FF0
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B40253_2_00007FF8A81B4025
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B37513_2_00007FF8A81B3751
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B3DE13_2_00007FF8A81B3DE1
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B515F3_2_00007FF8A81B515F
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B66EA3_2_00007FF8A81B66EA
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B4B423_2_00007FF8A81B4B42
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A83642603_2_00007FF8A8364260
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A82602003_2_00007FF8A8260200
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A82DC2403_2_00007FF8A82DC240
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B2C663_2_00007FF8A81B2C66
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B71E43_2_00007FF8A81B71E4
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A82F04503_2_00007FF8A82F0450
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B57403_2_00007FF8A81B5740
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B39813_2_00007FF8A81B3981
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81CC4803_2_00007FF8A81CC480
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B2BDA3_2_00007FF8A81B2BDA
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81CC6203_2_00007FF8A81CC620
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B70633_2_00007FF8A81B7063
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B31483_2_00007FF8A81B3148
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B17E93_2_00007FF8A81B17E9
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B111D3_2_00007FF8A81B111D
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B2C073_2_00007FF8A81B2C07
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B4E083_2_00007FF8A81B4E08
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B12EE3_2_00007FF8A81B12EE
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B736A3_2_00007FF8A81B736A
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B27703_2_00007FF8A81B2770
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A83659703_2_00007FF8A8365970
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B35EE3_2_00007FF8A81B35EE
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\netconn_properties.exeCode function: 7_2_00A1582D7_2_00A1582D
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\netconn_properties.exeCode function: 7_2_00A10A9B7_2_00A10A9B
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\netconn_properties.exeCode function: 7_2_00A0823C7_2_00A0823C
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\netconn_properties.exeCode function: 7_2_00A105F07_2_00A105F0
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\netconn_properties.exeCode function: 7_2_00A07EFA7_2_00A07EFA
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\registers.exeCode function: 10_2_002694B010_2_002694B0
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\netconn_properties.exeCode function: String function: 00A03FF0 appears 35 times
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: String function: 00007FF8A81B1055 appears 1131 times
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: String function: 00007FF8A81B207C appears 65 times
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: String function: 00007FF8A81B5E02 appears 543 times
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: String function: 00007FF73D7A1C50 appears 90 times
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: String function: 00007FF8A81B1C12 appears 98 times
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: String function: 00007FF8A81B4115 appears 285 times
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: String function: 00007FF8A81B46A6 appears 112 times
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: String function: 00007FF8A81B4214 appears 36 times
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: String function: 00007FF73D7A1CB0 appears 38 times
Source: win32ui.pyd.1.drStatic PE information: Resource name: RT_CURSOR type: DOS executable (COM, 0x8C-variant)
Source: win32ui.pyd.1.drStatic PE information: Resource name: RT_STRING type: DOS executable (COM)
Source: unicodedata.pyd.1.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: api-ms-win-core-handle-l1-1-0.dll.1.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.1.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.1.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.1.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.1.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.1.drStatic PE information: No import functions for PE file found
Source: python3.dll.1.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.1.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.1.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.1.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.1.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.1.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.1.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.1.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.1.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.1.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.1.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.1.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.1.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.1.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.1.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.1.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.1.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.1.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.1.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.1.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-multibyte-l1-1-0.dll.1.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.1.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.1.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.1.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.1.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.1.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-processenvironment-l1-1-0.dll.1.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.1.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.1.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.1.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.1.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.1.drStatic PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.1.drStatic PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.1.drStatic PE information: No import functions for PE file found
Source: xSO7sbN2j6.exe, 00000001.00000003.2230935199.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2232552994.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2232822044.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2245348776.000001EB0964B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32wnet.pyd0 vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2232106594.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2239664904.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2232918955.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2231419814.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2240170760.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2235950959.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2234782736.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2243434894.000001EB0963F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepythoncom38.dll0 vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2234634320.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2236165439.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2242231546.000001EB0963D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibsslH vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2243884643.000001EB0963F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2234396719.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2232435962.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2245250027.000001EB0964B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32trace.pyd0 vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2233290847.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2231219931.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2242552349.000001EB0963F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepyexpat.pyd. vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2230779110.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_elementtree.pyd. vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2239861973.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2239037297.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2244516546.000001EB0963F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2234547266.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2244843348.000001EB0963F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32api.pyd0 vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2231902757.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2238777336.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2233634128.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2239258092.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2232341692.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2230257256.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2233028833.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2245348776.000001EB0963F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32wnet.pyd0 vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2237358262.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2231615557.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2231807921.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2232671264.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2235634596.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2233543724.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2239987749.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2232218108.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2242717820.000001EB0963F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepython3.dll. vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2234300243.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2234146122.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2245250027.000001EB0963F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32trace.pyd0 vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2230655896.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2240443886.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2244989268.000001EB0963F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32net.pyd0 vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2244110686.000001EB0963F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameucrtbase.dllj% vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2230534838.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2243739150.000001EB0963F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepywintypes38.dll0 vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2233738349.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2231035454.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2235784465.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2244711265.000001EB0963F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_win32sysloader.pyd0 vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2241172247.000001EB0963D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameupx.exe( vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2230430431.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140_1.dllT vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2239479830.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2244711265.000001EB0964B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_win32sysloader.pyd0 vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2233416251.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2225271860.000001EB0963A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamemsvcp140.dllT vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2236972106.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2239773442.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2229733855.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32ui.pyd0 vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2245110481.000001EB0963F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamewin32security.pyd0 vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000001.00000003.2233871695.000001EB0963C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameapisetstubj% vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000003.00000002.2445756170.00007FF8B801B000.00000004.00000001.01000000.0000000C.sdmpBinary or memory string: OriginalFilenamepywintypes38.dll0 vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000003.00000002.2445996971.00007FF8B8112000.00000002.00000001.01000000.00000004.sdmpBinary or memory string: OriginalFilenameucrtbase.dllj% vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000003.00000002.2446611440.00007FF8B8CBC000.00000004.00000001.01000000.0000001B.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000003.00000002.2448841371.00007FF8BFAD6000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000003.00000002.2443805965.00007FF8A8E07000.00000004.00000001.01000000.00000005.sdmpBinary or memory string: OriginalFilenamepython38.dll. vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000003.00000002.2441390190.00007FF8A81A1000.00000004.00000001.01000000.0000001E.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000003.00000002.2448066086.00007FF8B9F69000.00000002.00000001.01000000.0000000D.sdmpBinary or memory string: OriginalFilenamevcruntime140_1.dllT vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000003.00000002.2442165063.00007FF8A84FE000.00000004.00000001.01000000.00000017.sdmpBinary or memory string: OriginalFilenamelibcryptoH vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000003.00000002.2445273022.00007FF8B78CB000.00000004.00000001.01000000.0000000F.sdmpBinary or memory string: OriginalFilenamewin32api.pyd0 vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000003.00000002.2448608318.00007FF8BA4F2000.00000002.00000001.01000000.00000007.sdmpBinary or memory string: OriginalFilenamepython3.dll. vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000003.00000002.2442708741.00007FF8A88F1000.00000004.00000001.01000000.00000019.sdmpBinary or memory string: OriginalFilenamelibsslH vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000003.00000002.2445053706.00007FF8B61E1000.00000004.00000001.01000000.00000014.sdmpBinary or memory string: OriginalFilenamewin32net.pyd0 vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000003.00000002.2447268382.00007FF8B9106000.00000004.00000001.01000000.00000008.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000003.00000002.2444783479.00007FF8B61BE000.00000004.00000001.01000000.00000015.sdmpBinary or memory string: OriginalFilenamewin32security.pyd0 vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000003.00000002.2446255115.00007FF8B8269000.00000004.00000001.01000000.00000011.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000003.00000002.2444222330.00007FF8B573C000.00000004.00000001.01000000.00000018.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000003.00000002.2444486642.00007FF8B6180000.00000004.00000001.01000000.00000016.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000003.00000002.2447618348.00007FF8B984C000.00000004.00000001.01000000.00000012.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000003.00000002.2447462091.00007FF8B93DB000.00000004.00000001.01000000.0000000A.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000003.00000002.2446968005.00007FF8B8F9D000.00000004.00000001.01000000.0000000B.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs xSO7sbN2j6.exe
Source: xSO7sbN2j6.exe, 00000003.00000002.2442979393.00007FF8A89BD000.00000004.00000001.01000000.0000000E.sdmpBinary or memory string: OriginalFilenamepythoncom38.dll0 vs xSO7sbN2j6.exe
Source: libcrypto-1_1.dll.1.drStatic PE information: Section: UPX1 ZLIB complexity 0.998678197927011
Source: libssl-1_1.dll.1.drStatic PE information: Section: UPX1 ZLIB complexity 0.9901204901603499
Source: python38.dll.1.drStatic PE information: Section: UPX1 ZLIB complexity 0.999271124301676
Source: pythoncom38.dll.1.drStatic PE information: Section: UPX1 ZLIB complexity 0.9918376865671642
Source: win32ui.pyd.1.drStatic PE information: Section: UPX1 ZLIB complexity 0.9930449695121951
Source: unicodedata.pyd.1.drStatic PE information: Section: UPX1 ZLIB complexity 0.9942785780669146
Source: _cffi.cp38-win_amd64.pyd.1.drStatic PE information: Section: UPX1 ZLIB complexity 0.995086669921875
Source: backend_c.cp38-win_amd64.pyd.1.drStatic PE information: Section: UPX1 ZLIB complexity 0.992855787803532
Source: classification engineClassification label: mal100.evad.winEXE@8/83@0/0
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7A6670 GetLastError,FormatMessageW,WideCharToMultiByte,1_2_00007FF73D7A6670
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3576:120:WilError_03
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682Jump to behavior
Source: xSO7sbN2j6.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: xSO7sbN2j6.exeReversingLabs: Detection: 15%
Source: xSO7sbN2j6.exeVirustotal: Detection: 16%
Source: xSO7sbN2j6.exeString found in binary or memory: set-addPolicy
Source: xSO7sbN2j6.exeString found in binary or memory: id-cmc-addExtensions
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile read: C:\Users\user\Desktop\xSO7sbN2j6.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\xSO7sbN2j6.exe "C:\Users\user\Desktop\xSO7sbN2j6.exe"
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeProcess created: C:\Users\user\Desktop\xSO7sbN2j6.exe "C:\Users\user\Desktop\xSO7sbN2j6.exe"
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeProcess created: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\netconn_properties.exe C:\Users\user\AppData\Local\Temp\_MEI12682\exe/netconn_properties.exe
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeProcess created: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\registers.exe C:\Users\user\AppData\Local\Temp\_MEI12682\exe/registers.exe
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeProcess created: C:\Users\user\Desktop\xSO7sbN2j6.exe "C:\Users\user\Desktop\xSO7sbN2j6.exe"Jump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeProcess created: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\netconn_properties.exe C:\Users\user\AppData\Local\Temp\_MEI12682\exe/netconn_properties.exeJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeProcess created: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\registers.exe C:\Users\user\AppData\Local\Temp\_MEI12682\exe/registers.exeJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeSection loaded: libffi-7.dllJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeSection loaded: vcruntime140_1.dllJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeSection loaded: secur32.dllJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeSection loaded: amsi.dllJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeSection loaded: sxs.dllJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeSection loaded: pdh.dllJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeSection loaded: logoncli.dllJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeSection loaded: samcli.dllJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeSection loaded: security.dllJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeSection loaded: ntdsapi.dllJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeSection loaded: libcrypto-1_1.dllJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeSection loaded: libssl-1_1.dllJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\netconn_properties.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\netconn_properties.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\netconn_properties.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\netconn_properties.exeSection loaded: netshell.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\netconn_properties.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\netconn_properties.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\netconn_properties.exeSection loaded: netsetupapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\netconn_properties.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\netconn_properties.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\registers.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\registers.exeSection loaded: msvcp140.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\registers.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\registers.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32Jump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile opened: C:\Users\user\Desktop\pyvenv.cfgJump to behavior
Source: xSO7sbN2j6.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: xSO7sbN2j6.exeStatic file information: File size 11440768 > 1048576
Source: xSO7sbN2j6.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: xSO7sbN2j6.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: xSO7sbN2j6.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: xSO7sbN2j6.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: xSO7sbN2j6.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: xSO7sbN2j6.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: xSO7sbN2j6.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Source: xSO7sbN2j6.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2239037297.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-locale-l1-1-0.dll.1.dr
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-3.8\Release\win32net.pdb source: xSO7sbN2j6.exe, 00000003.00000002.2444861222.00007FF8B61C1000.00000040.00000001.01000000.00000014.sdmp
Source: Binary string: C:\Users\c\source\repos\ConsoleApplication2\Release\ConsoleApplication2.pdb source: registers.exe, registers.exe, 0000000A.00000002.2415695027.0000000000261000.00000040.00000001.01000000.00000022.sdmp
Source: Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2239773442.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-runtime-l1-1-0.dll.1.dr
Source: Binary string: C:\A\34\b\bin\amd64\select.pdb source: xSO7sbN2j6.exe, 00000003.00000002.2447521757.00007FF8B9841000.00000040.00000001.01000000.00000012.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_A source: xSO7sbN2j6.exe
Source: Binary string: api-ms-win-core-file-l1-2-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2232435962.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.1.dr
Source: Binary string: ucrtbase.pdb source: xSO7sbN2j6.exe, 00000003.00000002.2445898778.00007FF8B80D5000.00000002.00000001.01000000.00000004.sdmp, ucrtbase.dll.1.dr
Source: Binary string: api-ms-win-core-memory-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2233416251.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-memory-l1-1-0.dll.1.dr
Source: Binary string: api-ms-win-core-debug-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2232106594.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-debug-l1-1-0.dll.1.dr
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-3.8\Release\pywintypes.pdb source: xSO7sbN2j6.exe, 00000003.00000002.2445592803.00007FF8B7FF1000.00000040.00000001.01000000.0000000C.sdmp
Source: Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2234782736.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.1.dr
Source: Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2237358262.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\A\34\b\bin\amd64\python38.pdb source: xSO7sbN2j6.exe, 00000003.00000002.2443034874.00007FF8A8CCC000.00000040.00000001.01000000.00000005.sdmp
Source: Binary string: C:\Users\c\source\repos\ConsoleApplication2\Release\ConsoleApplication2.pdb%% source: registers.exe, 0000000A.00000002.2415695027.0000000000261000.00000040.00000001.01000000.00000022.sdmp
Source: Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2239861973.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-3.8\Release\win32security.pdb source: xSO7sbN2j6.exe, 00000003.00000002.2444589477.00007FF8B6191000.00000040.00000001.01000000.00000015.sdmp
Source: Binary string: api-ms-win-core-heap-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2232822044.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\A\34\b\bin\amd64\python3.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2242717820.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2448608318.00007FF8BA4F2000.00000002.00000001.01000000.00000007.sdmp, python3.dll.1.dr
Source: Binary string: api-ms-win-core-util-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2235784465.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-synch-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2234547266.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-synch-l1-1-0.dll.1.dr
Source: Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2236972106.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-environment-l1-1-0.dll.1.dr
Source: Binary string: C:\A\34\b\bin\amd64\_ssl.pdb source: xSO7sbN2j6.exe, 00000003.00000002.2444067430.00007FF8B5711000.00000040.00000001.01000000.00000018.sdmp
Source: Binary string: D:\a01\_work\26\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2230257256.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2448737746.00007FF8BFAD1000.00000002.00000001.01000000.00000006.sdmp, VCRUNTIME140.dll.1.dr
Source: Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2232218108.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-errorhandling-l1-1-0.dll.1.dr
Source: Binary string: d:\a01\_work\12\s\\binaries\amd64ret\bin\amd64\\mfc140u.amd64.pdb source: mfc140u.dll.1.dr
Source: Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2233738349.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-0.dll.1.dr
Source: Binary string: d:\a01\_work\12\s\\binaries\amd64ret\bin\amd64\\mfc140u.amd64.pdbGCTL source: mfc140u.dll.1.dr
Source: Binary string: api-ms-win-core-console-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2231807921.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.1.dr
Source: Binary string: api-ms-win-core-file-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2232341692.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-file-l1-1-0.dll.1.dr
Source: Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2236165439.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\A\6\b\libssl-1_1.pdb source: xSO7sbN2j6.exe, xSO7sbN2j6.exe, 00000003.00000002.2442460559.00007FF8A88B4000.00000040.00000001.01000000.00000019.sdmp
Source: Binary string: C:\Users\b\source\repos\ConsoleApplication1\Release\ConsoleApplication1.pdb source: netconn_properties.exe, netconn_properties.exe, 00000007.00000002.2414728783.0000000000A01000.00000040.00000001.01000000.00000021.sdmp
Source: Binary string: api-ms-win-core-profile-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2234146122.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.1.dr
Source: Binary string: ucrtbase.pdbUGP source: xSO7sbN2j6.exe, 00000003.00000002.2445898778.00007FF8B80D5000.00000002.00000001.01000000.00000004.sdmp, ucrtbase.dll.1.dr
Source: Binary string: C:\A\34\b\bin\amd64\unicodedata.pdb source: xSO7sbN2j6.exe, 00000003.00000002.2441062409.00007FF8A8195000.00000040.00000001.01000000.0000001E.sdmp
Source: Binary string: api-ms-win-crt-time-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2240170760.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\a01\_work\26\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2230430431.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2447867332.00007FF8B9F65000.00000002.00000001.01000000.0000000D.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-3.8\Release\pythoncom.pdb}},GCTL source: xSO7sbN2j6.exe, 00000003.00000002.2442766857.00007FF8A8901000.00000040.00000001.01000000.0000000E.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\msvcp140.amd64.pdb source: MSVCP140.dll.1.dr
Source: Binary string: api-ms-win-core-handle-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2232671264.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\A\34\b\bin\amd64\_bz2.pdb source: xSO7sbN2j6.exe, 00000003.00000002.2447332028.00007FF8B93C1000.00000040.00000001.01000000.0000000A.sdmp
Source: Binary string: C:\A\34\b\bin\amd64\_lzma.pdbMM source: xSO7sbN2j6.exe, 00000003.00000002.2446708944.00007FF8B8F8D000.00000040.00000001.01000000.0000000B.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-3.8\Release\pywintypes.pdb** source: xSO7sbN2j6.exe, 00000003.00000002.2445592803.00007FF8B7FF1000.00000040.00000001.01000000.0000000C.sdmp
Source: Binary string: D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\msvcp140.amd64.pdbGCTL source: MSVCP140.dll.1.dr
Source: Binary string: api-ms-win-core-synch-l1-2-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2234634320.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-synch-l1-2-0.dll.1.dr
Source: Binary string: C:\A\34\b\bin\amd64\_hashlib.pdb source: xSO7sbN2j6.exe, 00000003.00000002.2444302392.00007FF8B6176000.00000040.00000001.01000000.00000016.sdmp
Source: Binary string: C:\A\6\b\libssl-1_1.pdb?? source: xSO7sbN2j6.exe, 00000003.00000002.2442460559.00007FF8A88B4000.00000040.00000001.01000000.00000019.sdmp
Source: Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2233634128.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processenvironment-l1-1-0.dll.1.dr
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: xSO7sbN2j6.exe, 00000003.00000002.2441450814.00007FF8A83F8000.00000040.00000001.01000000.00000017.sdmp
Source: Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2231902757.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-3.8\Release\win32net.pdb source: xSO7sbN2j6.exe, 00000003.00000002.2444861222.00007FF8B61C1000.00000040.00000001.01000000.00000014.sdmp
Source: Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2235950959.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-conio-l1-1-0.dll.1.dr
Source: Binary string: C:\A\34\b\bin\amd64\_socket.pdb source: xSO7sbN2j6.exe, 00000003.00000002.2446080851.00007FF8B8251000.00000040.00000001.01000000.00000011.sdmp
Source: Binary string: api-ms-win-core-localization-l1-2-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2233290847.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.1.dr
Source: Binary string: api-ms-win-crt-math-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2239258092.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\A\34\b\bin\amd64\_ctypes.pdb source: xSO7sbN2j6.exe, 00000003.00000002.2447129812.00007FF8B90E1000.00000040.00000001.01000000.00000008.sdmp
Source: Binary string: C:\A\34\b\bin\amd64\_lzma.pdb source: xSO7sbN2j6.exe, 00000003.00000002.2446708944.00007FF8B8F8D000.00000040.00000001.01000000.0000000B.sdmp
Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2233871695.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.1.dr
Source: Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2233543724.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-namedpipe-l1-1-0.dll.1.dr
Source: Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2239479830.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-multibyte-l1-1-0.dll.1.dr
Source: Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2240443886.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2234300243.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2235634596.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-core-timezone-l1-1-0.dll.1.dr
Source: Binary string: api-ms-win-core-string-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2234396719.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-file-l2-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2232552994.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-process-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2239664904.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-process-l1-1-0.dll.1.dr
Source: Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2233028833.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-3.8\Release\pythoncom.pdb source: xSO7sbN2j6.exe, xSO7sbN2j6.exe, 00000003.00000002.2442766857.00007FF8A8901000.00000040.00000001.01000000.0000000E.sdmp
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1k 25 Mar 2021built on: Tue Apr 6 11:26:02 2021 UTCplatform: VC-WIN64A-masmOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not available source: xSO7sbN2j6.exe, 00000003.00000002.2441450814.00007FF8A83F8000.00000040.00000001.01000000.00000017.sdmp
Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2232918955.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\A\34\b\bin\amd64\_queue.pdb source: xSO7sbN2j6.exe, 00000003.00000002.2446511663.00007FF8B8CB1000.00000040.00000001.01000000.0000001B.sdmp
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-3.8\Release\win32api.pdb source: xSO7sbN2j6.exe, 00000003.00000002.2445139659.00007FF8B78A1000.00000040.00000001.01000000.0000000F.sdmp
Source: Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2238777336.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-heap-l1-1-0.dll.1.dr
Source: Binary string: api-ms-win-crt-string-l1-1-0.pdb source: xSO7sbN2j6.exe, 00000001.00000003.2239987749.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, api-ms-win-crt-string-l1-1-0.dll.1.dr
Source: Binary string: C:\src\pywin32\build\temp.win-amd64-3.8\Release\win32api.pdb!! source: xSO7sbN2j6.exe, 00000003.00000002.2445139659.00007FF8B78A1000.00000040.00000001.01000000.0000000F.sdmp
Source: xSO7sbN2j6.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: xSO7sbN2j6.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: xSO7sbN2j6.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: xSO7sbN2j6.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: xSO7sbN2j6.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: api-ms-win-crt-process-l1-1-0.dll.1.drStatic PE information: 0xA8F275DA [Mon Oct 27 06:36:10 2059 UTC]
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A84FCDE0 EntryPoint,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,3_2_00007FF8A84FCDE0
Source: xSO7sbN2j6.exeStatic PE information: section name: _RDATA
Source: libffi-7.dll.1.drStatic PE information: section name: UPX2
Source: mfc140u.dll.1.drStatic PE information: section name: .didat
Source: VCRUNTIME140.dll.1.drStatic PE information: section name: _RDATA
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A80991E7 push rdi; iretd 3_2_00007FF8A80991E9
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A8099328 push r10; retf 3_2_00007FF8A8099391
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A8099C33 push rsp; retf 3_2_00007FF8A8099C34
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A8096C71 push r10; ret 3_2_00007FF8A8096C73
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A8096D16 push r8; ret 3_2_00007FF8A8096D23
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A8096D3A push r12; ret 3_2_00007FF8A8096D3C
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A8099DB1 push rsp; iretq 3_2_00007FF8A8099DB2
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A80985AF push rbp; retf 3_2_00007FF8A80985C8
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A80985F4 push r12; ret 3_2_00007FF8A8098630
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A8096E36 push rsp; ret 3_2_00007FF8A8096E3E
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A8096E7E push rdi; iretd 3_2_00007FF8A8096E80
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A8098EAA push rbp; iretq 3_2_00007FF8A8098EAB
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A8096EC5 push rsi; ret 3_2_00007FF8A8096EC6
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A8096EEF push r10; retf 3_2_00007FF8A8096EF2
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A8096F00 push r12; ret 3_2_00007FF8A8096F1E
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A8098F42 push r12; ret 3_2_00007FF8A8098F69
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A8096F63 push r12; ret 3_2_00007FF8A8096F7B
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A8098F97 push r12; iretd 3_2_00007FF8A8098FAE
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A8096F88 push r8; ret 3_2_00007FF8A8096F90
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A8096FC2 push r10; ret 3_2_00007FF8A8096FD5
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A809784D push rsi; ret 3_2_00007FF8A8097884
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\netconn_properties.exeCode function: 7_2_00A1B9FD push esi; ret 7_2_00A1BA06
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\netconn_properties.exeCode function: 7_2_00A15F41 push ecx; ret 7_2_00A15F54
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1
Source: initial sampleStatic PE information: section name: UPX0
Source: initial sampleStatic PE information: section name: UPX1

Persistence and Installation Behavior

barindex
Found pyInstaller with non standard icon
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeProcess created: "C:\Users\user\Desktop\xSO7sbN2j6.exe"
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-file-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\libssl-1_1.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\_hashlib.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-crt-time-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\pyexpat.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-crt-stdio-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\MSVCP140.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-console-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\win32\_win32sysloader.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-processenvironment-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-processthreads-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\netconn_properties.exeJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-crt-process-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-crt-filesystem-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-util-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-interlocked-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-string-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-crt-multibyte-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\ucrtbase.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-debug-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\win32\win32security.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-rtlsupport-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\libcrypto-1_1.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\libffi-7.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-crt-environment-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\_lzma.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\zstandard\_cffi.cp38-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-file-l1-2-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-libraryloader-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-localization-l1-2-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-memory-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-profile-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\registers.exeJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-crt-conio-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\_queue.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-crt-math-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\_socket.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-crt-heap-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\VCRUNTIME140_1.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\_ctypes.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-crt-utility-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-file-l2-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-synch-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\charset_normalizer\md.cp38-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-timezone-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\python38.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-heap-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\upx.exeJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\win32\win32net.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\unicodedata.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\_ssl.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-crt-convert-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\select.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\win32\win32api.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\Pythonwin\mfc140u.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\_bz2.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-sysinfo-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-crt-runtime-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\psutil\_psutil_windows.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-crt-locale-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-errorhandling-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\pywin32_system32\pywintypes38.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\_elementtree.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\VCRUNTIME140.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-handle-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-namedpipe-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-synch-l1-2-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\win32\win32wnet.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\python3.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\win32\win32trace.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\zstandard\backend_c.cp38-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\Pythonwin\win32ui.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\pywin32_system32\pythoncom38.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-processthreads-l1-1-1.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\charset_normalizer\md__mypyc.cp38-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-crt-string-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-datetime-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7A2F20 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,1_2_00007FF73D7A2F20
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Malware Analysis System Evasion

barindex
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\registers.exeCode function: 10_2_00261520 10_2_00261520
Queries BIOS fan information (via WMI, Win32_Fan, often done to detect virtual machines)
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Fan
Queries memory information (via WMI often done to detect virtual machines)
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_CacheMemory
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_MemoryDevice
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_MemoryArray
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM CIM_MemoryCapacity
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_SMBIOSMemory
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM CIM_Memory
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PhysicalMemory
Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_NetworkAdapter
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PhysicalMemory
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_LogicalDisk
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Queries temperature or sensor information (via WMI often done to detect virtual machines)
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM CIM_NumericSensor
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM CIM_Sensor
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM CIM_TemperatureSensor
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PerfFormattedData_Counters_ThermalZoneInformation
Queries voltage information (via WMI often done to detect virtual machines)
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VoltageProbe
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM CIM_VoltageSensor
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\registers.exeRDTSC instruction interceptor: First address: 261592 second address: 26159C instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [esp+44h], eax 0x00000006 mov dword ptr [esp+40h], edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\registers.exeRDTSC instruction interceptor: First address: 26159C second address: 2615A6 instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [esp+3Ch], eax 0x00000006 mov dword ptr [esp+38h], edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\registers.exeRDTSC instruction interceptor: First address: 2615A6 second address: 2615B0 instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [esp+34h], eax 0x00000006 mov dword ptr [esp+30h], edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\registers.exeRDTSC instruction interceptor: First address: 2615B0 second address: 2615BA instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [esp+2Ch], eax 0x00000006 mov dword ptr [esp+28h], edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\registers.exeRDTSC instruction interceptor: First address: 2615BA second address: 2615CA instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [esp+24h], eax 0x00000006 xor eax, eax 0x00000008 push ebx 0x00000009 mov dword ptr [esp+24h], edx 0x0000000d cpuid 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\registers.exeRDTSC instruction interceptor: First address: 2615CA second address: 2615DC instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [esp+1Ch], eax 0x00000006 xor ecx, ecx 0x00000008 xor eax, eax 0x0000000a mov dword ptr [esp+18h], edx 0x0000000e push ebx 0x0000000f cpuid 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\registers.exeRDTSC instruction interceptor: First address: 2615DC second address: 2615EE instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [esp+14h], eax 0x00000006 xor ecx, ecx 0x00000008 xor eax, eax 0x0000000a mov dword ptr [esp+10h], edx 0x0000000e push ebx 0x0000000f cpuid 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\registers.exeCode function: 10_2_00261520 rdtsc 10_2_00261520
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\registers.exeCode function: 10_2_00261520 sgdt fword ptr [esp+000000B0h]10_2_00261520
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\registers.exeCode function: 10_2_00261520 sidt fword ptr [esp+000000A8h]10_2_00261520
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-file-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\_hashlib.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-crt-time-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\pyexpat.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-crt-stdio-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\win32\_win32sysloader.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-processthreads-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-console-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-processenvironment-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-crt-process-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-crt-filesystem-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-util-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-string-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-interlocked-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-crt-multibyte-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\win32\win32security.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-debug-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-rtlsupport-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-crt-environment-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\_lzma.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\zstandard\_cffi.cp38-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-file-l1-2-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-localization-l1-2-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-libraryloader-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-memory-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-profile-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-crt-conio-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\_queue.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-crt-math-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\_socket.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-crt-heap-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\_ctypes.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-crt-utility-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-file-l2-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-synch-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\charset_normalizer\md.cp38-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-timezone-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\python38.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-heap-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\upx.exeJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\win32\win32net.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\unicodedata.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\_ssl.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-crt-convert-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\select.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\win32\win32api.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\_bz2.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\Pythonwin\mfc140u.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-sysinfo-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-crt-runtime-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-crt-locale-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\psutil\_psutil_windows.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-errorhandling-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\pywin32_system32\pywintypes38.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\_elementtree.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-handle-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-namedpipe-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-synch-l1-2-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\win32\win32wnet.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\win32\win32trace.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\python3.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\zstandard\backend_c.cp38-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\pywin32_system32\pythoncom38.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-processthreads-l1-1-1.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\Pythonwin\win32ui.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\charset_normalizer\md__mypyc.cp38-win_amd64.pydJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-datetime-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-crt-string-l1-1-0.dllJump to dropped file
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_1-16586
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeAPI coverage: 7.9 %
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\netconn_properties.exeAPI coverage: 6.0 %
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BaseBoard
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystem
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7B6878 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,1_2_00007FF73D7B6878
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7A69E0 FindFirstFileExW,FindClose,1_2_00007FF73D7A69E0
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7C0A34 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,1_2_00007FF73D7C0A34
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7B6878 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,1_2_00007FF73D7B6878
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7B6878 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,3_2_00007FF73D7B6878
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7C0A34 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,3_2_00007FF73D7C0A34
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7B6878 _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,3_2_00007FF73D7B6878
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7A69E0 FindFirstFileExW,FindClose,3_2_00007FF73D7A69E0
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B4480 MultiByteToWideChar,GetLastError,MultiByteToWideChar,MultiByteToWideChar,00007FF8C610F020,FindFirstFileW,FindNextFileW,WideCharToMultiByte,3_2_00007FF8A81B4480
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\netconn_properties.exeCode function: 7_2_00A0CD11 FindFirstFileExW,7_2_00A0CD11
Source: xSO7sbN2j6.exe, 00000003.00000003.2422434748.0000021030111000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: D9SCX8F8 VMCI Bus Device
Source: xSO7sbN2j6.exe, 00000003.00000003.2424369615.00000210307E1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: stringComputer System ProductComputer System Product6GAYZ12ED92742-89DC-DD72-92E8-869FA5A66493VMware, Inc.None
Source: xSO7sbN2j6.exe, 00000003.00000003.2424369615.00000210307E1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware, Inc.
Source: xSO7sbN2j6.exe, 00000003.00000003.2428147875.000002102E64D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Win32_PnPEntityU8VE67KY VMCI Bus Device{4d36e97d-e325-11ce-bfc1-08002be10318}System.String[]Win32_PnPEntityZY4E1A5N VMCI Bus DevicePCI\D_H5H1V6&DEV_0740&SUBSYS_074015AD&REV_10\3&61AAA01&0&3FSystem.String[]VMware, Inc.D
Source: xSO7sbN2j6.exe, 00000003.00000002.2440026777.0000021031050000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: VMware Virtual RAM0
Source: xSO7sbN2j6.exe, 00000003.00000003.2422434748.0000021030111000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: U8VE67KY VMCI Bus Device
Source: xSO7sbN2j6.exe, 00000003.00000003.2420878508.00000210307FD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Win32_PhysicalMemoryPhysical Memory 0Win32_PhysicalMemoryPhysical MemoryPhysical MemoryPhysical MemoryRAM slot #0RAM slot #0VMware Virtual RAM00000001VMW-4096MBLMEM
Source: xSO7sbN2j6.exe, 00000003.00000003.2421755441.0000021031790000.00000004.00001000.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2297584953.00000210307FF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Microsoft Hyper-V Generation Counter
Source: xSO7sbN2j6.exe, 00000003.00000003.2430979576.0000021030172000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2427750884.000002103016B000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2423625603.0000021030163000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2432460343.0000021030173000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2257911551.00000210300E3000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2423685730.000002103016A000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2423437104.0000021030111000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2436306792.0000021030174000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2422434748.0000021030111000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2430089157.0000021030171000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: xSO7sbN2j6.exe, 00000003.00000002.2439982644.0000021031000000.00000004.00001000.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2297912338.00000210307D8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: xSO7sbN2j6.exe, 00000003.00000003.2297912338.00000210307D8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Win32_PnPEntityMicrosoft Hyper-V Virtualization Infrastructure Driver{4d36e97d-e325-11ce-bfc1-08002be10318}Win32_PnPEntityMicrosoft Hyper-V Virtualization Infrastructure DriverROOT\VID\0000System.String[]MicrosoftMicrosoft Hyper-V Virtualization Infrastructure DriverSystemROOT\VID\0000VidOKWin32_ComputerSystemuser-PC
Source: xSO7sbN2j6.exe, 00000003.00000003.2297584953.00000210307FF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Win32_PnPEntityMicrosoft Hyper-V Generation Counter{4d36e97d-e325-11ce-bfc1-08002be10318}System.String[]Win32_PnPEntityMicrosoft Hyper-V Generation CounterACPI\VMW0001\7System.String[]MicrosoftMicrosoft Hyper-V Generation CounterSystemACPI\VMW0001\7gencounterOKWin32_ComputerSystemuser-PC
Source: xSO7sbN2j6.exe, 00000003.00000003.2420878508.00000210307FD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware Virtual RAM
Source: xSO7sbN2j6.exe, 00000003.00000002.2435267835.000002102E64D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Win32_PnPEntityU8VE67KY VMCI Bus Device{4d36e97d-e325-11ce-bfc1-08002be10318}System.Stp
Source: xSO7sbN2j6.exe, 00000003.00000003.2421755441.0000021031790000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: Microsoft Hyper-V Generation Countercthingp
Source: xSO7sbN2j6.exe, 00000003.00000003.2421755441.0000021031790000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: Microsoft Hyper-V Generation Countercthing0
Source: xSO7sbN2j6.exe, 00000003.00000003.2421755441.0000021031790000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: Microsoft Hyper-V Generation CountercthingP
Source: xSO7sbN2j6.exe, 00000003.00000002.2440334952.0000021031390000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: ZY4E1A5N VMCI Bus Device
Source: xSO7sbN2j6.exe, 00000003.00000003.2427487296.00000210313D0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: VMware, Inc..p
Source: xSO7sbN2j6.exe, 00000003.00000002.2435267835.000002102E64D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Win32_PnPEntityZY4E1A5N VMCI Bus DevicePCI\D_H5H1V6&DEV_0740&SUBSYS_074015AD&REV_10\3&61AAA01&0&3FSystem.String[]VMware, Inc.D
Source: xSO7sbN2j6.exe, 00000003.00000003.2422434748.0000021030111000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Win32_PnPEntityU8VE67KY VMCI Bus Device{4d36e97d-e325-11ce-bfc1-08002be10318}System.String[]Win32_PnPEntityZY4E1A5N VMCI Bus DevicePCI\D_H5H1V6&DEV_0740&SUBSYS_074015AD&REV_10\3&61AAA01&0&3FSystem.String[]VMware, Inc.D9SCX8F8 VMCI Bus DeviceSystemPCI\9GOTKCRT&DEV_0740&SUBSYS_074015AD&REV_10\3&61AAA01&0&3FvmciOKWin32_ComputerSystemuser-PC
Source: xSO7sbN2j6.exe, 00000003.00000002.2440237150.00000210312D0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: VMware, Inc..
Source: xSO7sbN2j6.exe, 00000003.00000002.2439982644.0000021031000000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driverp
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\registers.exeCode function: 10_2_00261520 rdtsc 10_2_00261520
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7AAA2C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00007FF73D7AAA2C
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A84FCDE0 EntryPoint,LoadLibraryA,GetProcAddress,VirtualProtect,VirtualProtect,VirtualProtect,3_2_00007FF8A84FCDE0
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7C2620 GetProcessHeap,1_2_00007FF73D7C2620
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7AAA2C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00007FF73D7AAA2C
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7AA180 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,1_2_00007FF73D7AA180
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7B9C44 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00007FF73D7B9C44
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7AABD4 SetUnhandledExceptionFilter,1_2_00007FF73D7AABD4
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7AAA2C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_00007FF73D7AAA2C
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7AA180 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,3_2_00007FF73D7AA180
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7B9C44 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_00007FF73D7B9C44
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF73D7AABD4 SetUnhandledExceptionFilter,3_2_00007FF73D7AABD4
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A8093354 IsProcessorFeaturePresent,00007FF8BFAC19A0,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,00007FF8BFAC19A0,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_00007FF8A8093354
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 3_2_00007FF8A81B5001 __scrt_fastfail,IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_00007FF8A81B5001
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\netconn_properties.exeCode function: 7_2_00A03906 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,7_2_00A03906
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\netconn_properties.exeCode function: 7_2_00A03DAE IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,7_2_00A03DAE
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\netconn_properties.exeCode function: 7_2_00A08DD4 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,7_2_00A08DD4
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\netconn_properties.exeCode function: 7_2_00A03F10 SetUnhandledExceptionFilter,7_2_00A03F10
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\registers.exeCode function: 10_2_00261805 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,10_2_00261805
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\registers.exeCode function: 10_2_00261F77 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,10_2_00261F77
Source: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\registers.exeCode function: 10_2_002620D9 SetUnhandledExceptionFilter,10_2_002620D9
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeProcess created: C:\Users\user\Desktop\xSO7sbN2j6.exe "C:\Users\user\Desktop\xSO7sbN2j6.exe"Jump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeProcess created: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\netconn_properties.exe C:\Users\user\AppData\Local\Temp\_MEI12682\exe/netconn_properties.exeJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeProcess created: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\registers.exe C:\Users\user\AppData\Local\Temp\_MEI12682\exe/registers.exeJump to behavior
Source: xSO7sbN2j6.exe, 00000003.00000002.2437458016.00000210305D0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: DOF_PROGMAN0
Source: xSO7sbN2j6.exe, 00000003.00000002.2437458016.00000210305D0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: DOF_PROGMAN
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7C8A30 cpuid 1_2_00007FF73D7C8A30
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\Pythonwin VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\charset_normalizer VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\zstandard VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\certifi VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\ucrtbase.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\_ctypes.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\_bz2.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\_lzma.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\Pythonwin VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\0muh7zmj VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\tmp179_cpv3 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\pywin32_system32\pywintypes38.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\pywin32_system32\pythoncom38.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\win32\win32api.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\Pythonwin VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\Pythonwin VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\Pythonwin VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\tmp179_cpv3 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\tmp179_cpv3\gen_py\__init__.py VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\tmp179_cpv3\gen_py\dicts.dat VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\_socket.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\select.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\psutil VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\psutil VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\psutil VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\psutil\_psutil_windows.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\win32\win32net.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\win32\win32security.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\_hashlib.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\_ssl.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\zstandard VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\zstandard VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\zstandard VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\zstandard\backend_c.cp38-win_amd64.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\_queue.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\Pythonwin VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\Pythonwin VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\pywin32_system32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\charset_normalizer VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\charset_normalizer VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\charset_normalizer VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\charset_normalizer\md.cp38-win_amd64.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\charset_normalizer VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\charset_normalizer\md__mypyc.cp38-win_amd64.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\unicodedata.pyd VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\Pythonwin VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\win32 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\Pythonwin VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\Desktop\xSO7sbN2j6.exe VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeQueries volume information: C:\Users\user\AppData\Local\Temp\tmp179_cpv3 VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7AA910 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,1_2_00007FF73D7AA910
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeCode function: 1_2_00007FF73D7C4EA0 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,1_2_00007FF73D7C4EA0
Source: C:\Users\user\Desktop\xSO7sbN2j6.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts1031
Windows Management Instrumentation		1
DLL Side-Loading		12
Process Injection		54
Virtualization/Sandbox Evasion		OS Credential Dumping2
System Time Discovery		Remote Services1
Archive Collected Data		1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault Accounts2
Command and Scripting Interpreter		Boot or Logon Initialization Scripts1
DLL Side-Loading		12
Process Injection		LSASS Memory1351
Security Software Discovery		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts2
Native API		Logon Script (Windows)Logon Script (Windows)1
Deobfuscate/Decode Files or Information		Security Account Manager54
Virtualization/Sandbox Evasion		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook21
Obfuscated Files or Information		NTDS1
Process Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script11
Software Packing		LSA Secrets1
File and Directory Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
Timestomp		Cached Domain Credentials444
System Information Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
DLL Side-Loading		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
xSO7sbN2j6.exe16%ReversingLabsWin64.Malware.Generic
xSO7sbN2j6.exe17%VirustotalBrowse

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\user\AppData\Local\Temp\_MEI12682\MSVCP140.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI12682\MSVCP140.dll0%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI12682\Pythonwin\mfc140u.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI12682\Pythonwin\mfc140u.dll0%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI12682\Pythonwin\win32ui.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI12682\Pythonwin\win32ui.pyd0%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI12682\VCRUNTIME140.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI12682\VCRUNTIME140.dll0%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI12682\VCRUNTIME140_1.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI12682\VCRUNTIME140_1.dll0%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI12682\_bz2.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI12682\_bz2.pyd1%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI12682\_ctypes.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI12682\_ctypes.pyd1%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI12682\_elementtree.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI12682\_elementtree.pyd1%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI12682\_hashlib.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI12682\_hashlib.pyd0%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI12682\_lzma.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI12682\_lzma.pyd4%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI12682\_queue.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI12682\_queue.pyd1%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI12682\_socket.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI12682\_socket.pyd1%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI12682\_ssl.pyd0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI12682\_ssl.pyd0%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-console-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-console-l1-1-0.dll0%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-datetime-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-datetime-l1-1-0.dll0%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-debug-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-debug-l1-1-0.dll0%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-errorhandling-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-errorhandling-l1-1-0.dll0%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-file-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-file-l1-1-0.dll0%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-file-l1-2-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-file-l1-2-0.dll0%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-file-l2-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-file-l2-1-0.dll0%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-handle-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-handle-l1-1-0.dll0%VirustotalBrowse
C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-heap-l1-1-0.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-heap-l1-1-0.dll0%VirustotalBrowse

Unpacked PE Files

⊘No Antivirus matches

Domains

SourceDetectionScannerLabelLink
fp2e7a.wpc.phicdn.net0%VirustotalBrowse

URLs

SourceDetectionScannerLabelLink
http://ocsp.thawte.com00%URL Reputationsafe
http://www.cl.cam.ac.uk/~mgk25/iso-time.html0%URL Reputationsafe
https://foss.heptapod.net/pypy/pypy/-/issues/35390%URL Reputationsafe
https://www.mandiant.com/resources/blog/tracking-malware-import-hashing0%VirustotalBrowse
https://auscitte.github.io/systems%20blog/Exception-Directory-pefile#implementation-details0%VirustotalBrowse
http://timgolden.me.uk/python/wmi.html0%VirustotalBrowse
http://193.17.183.14:3000/0%VirustotalBrowse

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
fp2e7a.wpc.phicdn.net
192.229.211.108
truefalseunknown

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
http://google.com/xSO7sbN2j6.exe, 00000003.00000003.2423714607.000002103020C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2422096808.00000210301C9000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2423197574.00000210301C9000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2436577050.0000021030211000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2431934560.000002103020D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2426840147.000002103021A000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2433468001.000002103020E000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2433810897.0000021030210000.00000004.00000020.00020000.00000000.sdmpfalse
    		high
    https://mahler:8092/site-updates.pyxSO7sbN2j6.exe, 00000003.00000003.2427260813.00000210306C3000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2420272100.00000210306B1000.00000004.00000020.00020000.00000000.sdmpfalse
      		low
      https://github.com/urllib3/urllib3/issues/29200xSO7sbN2j6.exe, 00000003.00000002.2439623686.0000021030DC0000.00000004.00001000.00020000.00000000.sdmpfalse
        		high
        https://github.com/giampaolo/psutil/issues/875.xSO7sbN2j6.exe, 00000003.00000002.2437139354.0000021030370000.00000004.00001000.00020000.00000000.sdmpfalse
          		high
          http://.../back.jpegxSO7sbN2j6.exe, 00000003.00000002.2439755385.0000021030E90000.00000004.00001000.00020000.00000000.sdmpfalse
            		low
            http://www.python.org/xSO7sbN2j6.exe, 00000003.00000003.2427260813.00000210306C3000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2420272100.00000210306B1000.00000004.00000020.00020000.00000000.sdmpfalse
              		high
              https://github.com/mhammond/pywin32xSO7sbN2j6.exe, 00000001.00000003.2245348776.000001EB0964B000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2243434894.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2245250027.000001EB0964B000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2244843348.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2245348776.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2245250027.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2244989268.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2243739150.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2244711265.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2244711265.000001EB0964B000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2229733855.000001EB0963C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000001.00000003.2245110481.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2445756170.00007FF8B801B000.00000004.00000001.01000000.0000000C.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2445273022.00007FF8B78CB000.00000004.00000001.01000000.0000000F.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2445053706.00007FF8B61E1000.00000004.00000001.01000000.00000014.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2444783479.00007FF8B61BE000.00000004.00000001.01000000.00000015.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2442979393.00007FF8A89BD000.00000004.00000001.01000000.0000000E.sdmp, win32security.pyd.1.dr, win32trace.pyd.1.dr, win32net.pyd.1.dr, win32api.pyd.1.drfalse
                		high
                https://httpbin.org/postxSO7sbN2j6.exe, 00000003.00000003.2422877879.0000021030674000.00000004.00000020.00020000.00000000.sdmpfalse
                  		high
                  http://193.17.183.14:3000/)xSO7sbN2j6.exe, 00000003.00000003.2254594450.000002102E6DF000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2435457331.000002102E6DF000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2432907096.000002102E6DF000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2431258852.000002102E6DF000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2422307122.000002102E6DF000.00000004.00000020.00020000.00000000.sdmpfalse
                    		unknown
                    https://github.com/Ousret/charset_normalizerxSO7sbN2j6.exe, 00000003.00000003.2422096808.00000210301C9000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2425207464.0000021030208000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2423197574.00000210301C9000.00000004.00000020.00020000.00000000.sdmpfalse
                      		high
                      https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#xSO7sbN2j6.exe, 00000003.00000003.2428147875.000002102E61C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2251857001.000002102DE12000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2431983853.000002102DE25000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2251711442.000002102DE23000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2435267835.000002102E620000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2252362356.000002102DE12000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2434678392.000002102DE25000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2429262032.000002102DE24000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2429012313.000002102DE17000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2251408429.000002102DE12000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2252165282.000002102DE23000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2428839810.000002102DE12000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2422739995.000002102DE12000.00000004.00000020.00020000.00000000.sdmpfalse
                        		high
                        https://github.com/urllib3/urllib3/issues/2920xSO7sbN2j6.exe, 00000003.00000002.2439623686.0000021030DC0000.00000004.00001000.00020000.00000000.sdmpfalse
                          		high
                          http://www.python.org/download/releases/2.3/mro/.xSO7sbN2j6.exe, 00000003.00000002.2435047798.000002102DFB0000.00000004.00001000.00020000.00000000.sdmpfalse
                            		high
                            https://yahoo.com/xSO7sbN2j6.exe, 00000003.00000003.2423714607.000002103020C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2422096808.00000210301C9000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2423197574.00000210301C9000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2423367529.0000021030687000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2426840147.000002103021A000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2422877879.0000021030674000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2433603496.000002103068A000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2424521540.000002103068A000.00000004.00000020.00020000.00000000.sdmpfalse
                              		high
                              https://tools.ietf.org/html/rfc2388#section-4.4xSO7sbN2j6.exe, 00000003.00000003.2426690756.00000210300F3000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2431068921.00000210300FB000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2422434748.0000021030084000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2423437104.0000021030085000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2432380367.0000021030100000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                http://www.opensource.org/licenses/mit-license.phpxSO7sbN2j6.exe, 00000003.00000002.2435832830.0000021030030000.00000004.00001000.00020000.00000000.sdmpfalse
                                  		high
                                  http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6xSO7sbN2j6.exe, 00000003.00000003.2423714607.000002103020C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2422096808.00000210301C9000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2423197574.00000210301C9000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2436577050.0000021030211000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2431934560.000002103020D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2433468001.000002103020E000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2433810897.0000021030210000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    http://crl.thawte.com/ThawteTimestampingCA.crl0xSO7sbN2j6.exe, 00000001.00000003.2242054897.000001EB0963D000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      https://html.spec.whatwg.org/multipage/xSO7sbN2j6.exe, 00000003.00000003.2423714607.000002103020C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2422096808.00000210301C9000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2423197574.00000210301C9000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2431934560.000002103020D000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        https://urllib3.readthedocs.io/en/latest/advanced-usage.html#tls-warningsxSO7sbN2j6.exe, 00000003.00000002.2439438753.0000021030CA0000.00000004.00001000.00020000.00000000.sdmpfalse
                                          		high
                                          http://mail.python.org/pipermail/python-dev/2012-June/120787.htmlxSO7sbN2j6.exe, 00000003.00000002.2437083752.0000021030330000.00000004.00001000.00020000.00000000.sdmpfalse
                                            		high
                                            https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963xSO7sbN2j6.exe, 00000003.00000002.2439352613.0000021030C20000.00000004.00001000.00020000.00000000.sdmpfalse
                                              		high
                                              http://www.iana.org/time-zones/repository/tz-link.htmlxSO7sbN2j6.exe, 00000003.00000002.2435883667.0000021030070000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                http://goo.gl/zeJZlxSO7sbN2j6.exe, 00000003.00000002.2437139354.0000021030370000.00000004.00001000.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://requests.readthedocs.ioxSO7sbN2j6.exe, 00000003.00000003.2422877879.0000021030674000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2439890285.0000021030F80000.00000004.00001000.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2437590272.0000021030675000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://upx.github.ioTxSO7sbN2j6.exe, 00000001.00000003.2241172247.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, upx.exe.1.drfalse
                                                      		unknown
                                                      http://curl.haxx.se/rfc/cookie_spec.htmlxSO7sbN2j6.exe, 00000003.00000002.2439755385.0000021030E90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                        		high
                                                        http://www.python.org/dev/peps/pep-0205/xSO7sbN2j6.exe, 00000001.00000003.2246060805.000001EB0963F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2435780956.000002102FFF0000.00000004.00001000.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2254594450.000002102E62E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://www.mandiant.com/resources/blog/tracking-malware-import-hashingxSO7sbN2j6.exe, 00000003.00000002.2436994535.00000210302B0000.00000004.00001000.00020000.00000000.sdmpfalseunknown
                                                          http://json.orgxSO7sbN2j6.exe, 00000003.00000003.2254594450.000002102E62E000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2433190982.0000021030082000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2422434748.0000021030084000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2432907096.000002102E6DF000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2431258852.000002102E6DF000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2422307122.000002102E6DF000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2428983620.0000021030085000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2423437104.0000021030085000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2433913042.0000021030089000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2422597636.000002103007F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2431770423.0000021030086000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://urllib3.readthedocs.io/en/latest/advanced-usage.html#https-proxy-error-http-proxyxSO7sbN2j6.exe, 00000003.00000002.2439623686.0000021030DC0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688xSO7sbN2j6.exe, 00000003.00000002.2434833250.000002102DE70000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                		high
                                                                http://python.org/dev/peps/pep-0263/xSO7sbN2j6.exe, 00000003.00000002.2443034874.00007FF8A8CCC000.00000040.00000001.01000000.00000005.sdmpfalse
                                                                  		high
                                                                  https://httpbin.org/getxSO7sbN2j6.exe, 00000003.00000003.2420272100.000002103071B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    http://193.17.183.14:3000/xSO7sbN2j6.exe, 00000003.00000002.2436948556.0000021030270000.00000004.00001000.00020000.00000000.sdmpfalseunknown
                                                                    https://www.python.orgxSO7sbN2j6.exe, 00000003.00000003.2422877879.0000021030674000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://auscitte.github.io/systems%20blog/Exception-Directory-pefile#implementation-detailsxSO7sbN2j6.exe, 00000003.00000002.2437313978.0000021030500000.00000004.00001000.00020000.00000000.sdmpfalseunknown
                                                                      https://stackoverflow.com/questions/4457745#4457745xSO7sbN2j6.exe, 00000003.00000002.2437139354.0000021030370000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        http://ocsp.thawte.com0xSO7sbN2j6.exe, 00000001.00000003.2242054897.000001EB0963D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        • URL Reputation: safe
                                                                        		unknown
                                                                        https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/readerxSO7sbN2j6.exe, 00000003.00000003.2428147875.000002102E61C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2251857001.000002102DE12000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2431983853.000002102DE25000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2251711442.000002102DE23000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2435267835.000002102E620000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2252362356.000002102DE12000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2434678392.000002102DE25000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2429262032.000002102DE24000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2429012313.000002102DE17000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2251408429.000002102DE12000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2252165282.000002102DE23000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2428839810.000002102DE12000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2422739995.000002102DE12000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://httpbin.org/xSO7sbN2j6.exe, 00000003.00000003.2423290501.000002102E669000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            http://www.cl.cam.ac.uk/~mgk25/iso-time.htmlxSO7sbN2j6.exe, 00000003.00000002.2435883667.0000021030070000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • URL Reputation: safe
                                                                            		unknown
                                                                            https://twitter.com/xSO7sbN2j6.exe, 00000003.00000003.2422096808.00000210301C9000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2425207464.0000021030208000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2423197574.00000210301C9000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2423290501.000002102E669000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              http://hg.python.org/cpython/file/603b4d593758/Lib/socket.py#l535xSO7sbN2j6.exe, 00000003.00000003.2426690756.00000210300F3000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2431068921.00000210300FB000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2422434748.0000021030084000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2423437104.0000021030085000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_syxSO7sbN2j6.exe, 00000003.00000003.2428147875.000002102E61C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2251857001.000002102DE12000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2431983853.000002102DE25000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2251711442.000002102DE23000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2435267835.000002102E620000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2252362356.000002102DE12000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2434678392.000002102DE25000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2429262032.000002102DE24000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2429012313.000002102DE17000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2251408429.000002102DE12000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2252165282.000002102DE23000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2428839810.000002102DE12000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2422739995.000002102DE12000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://google.com/xSO7sbN2j6.exe, 00000003.00000003.2423197574.00000210301C9000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2423367529.0000021030687000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2423290501.000002102E669000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2426840147.000002103021A000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2422877879.0000021030674000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2433603496.000002103068A000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2424521540.000002103068A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    http://www.ntcore.com/files/richsign.htmxSO7sbN2j6.exe, 00000003.00000002.2435832830.0000021030030000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://google.com/mail/xSO7sbN2j6.exe, 00000003.00000003.2422434748.0000021030111000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        http://google.com/mail/xSO7sbN2j6.exe, 00000003.00000003.2423625603.0000021030163000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2427750884.0000021030164000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2423437104.0000021030111000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2422434748.0000021030111000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          http://wwwsearch.sf.net/):xSO7sbN2j6.exe, 00000003.00000003.2427260813.00000210306C3000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2437767537.00000210306C4000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2420272100.00000210306B1000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2430312247.00000210306C4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            http://tools.ietf.org/html/rfc6125#section-6.4.3xSO7sbN2j6.exe, 00000003.00000002.2439623686.0000021030DC0000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              http://timgolden.me.uk/python/wmi.htmlxSO7sbN2j6.exe, 00000003.00000002.2436948556.0000021030270000.00000004.00001000.00020000.00000000.sdmpfalseunknown
                                                                                              https://www.openssl.org/HxSO7sbN2j6.exe, 00000001.00000003.2242231546.000001EB0963D000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2442165063.00007FF8A84FE000.00000004.00000001.01000000.00000017.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2442708741.00007FF8A88F1000.00000004.00000001.01000000.00000019.sdmp, libssl-1_1.dll.1.drfalse
                                                                                                		high
                                                                                                https://docs.python.org/3/library/socket.html#socket.socket.connect_exxSO7sbN2j6.exe, 00000003.00000002.2439890285.0000021030F80000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  https://google.com/mailxSO7sbN2j6.exe, 00000003.00000003.2423714607.000002103020C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2422096808.00000210301C9000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2423197574.00000210301C9000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2423367529.0000021030687000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2426840147.000002103021A000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2422877879.0000021030674000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2433603496.000002103068A000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2424521540.000002103068A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.pyxSO7sbN2j6.exe, 00000003.00000003.2422739995.000002102DE12000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://foss.heptapod.net/pypy/pypy/-/issues/3539xSO7sbN2j6.exe, 00000003.00000002.2439352613.0000021030C20000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                      • URL Reputation: safe
                                                                                                      		unknown
                                                                                                      https://github.com/urllib3/urllib3/issues/2513#issuecomment-1152559900.xSO7sbN2j6.exe, 00000003.00000003.2423714607.000002103020C000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2422096808.00000210301C9000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2423197574.00000210301C9000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2433838314.0000021030224000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2431674157.000002103021F000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000002.2436577050.0000021030225000.00000004.00000020.00020000.00000000.sdmp, xSO7sbN2j6.exe, 00000003.00000003.2426840147.000002103021A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        		high

                                                                                                        World Map of Contacted IPs

                                                                                                        ⊘No contacted IP infos

                                                                                                        General Information

                                                                                                        Joe Sandbox version:40.0.0 Tourmaline
                                                                                                        Analysis ID:1428491
                                                                                                        Start date and time:2024-04-19 02:44:38 +02:00
                                                                                                        Joe Sandbox product:CloudBasic
                                                                                                        Overall analysis duration:0h 9m 9s
                                                                                                        Hypervisor based Inspection enabled:false
                                                                                                        Report type:full
                                                                                                        Cookbook file name:default.jbs
                                                                                                        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                        Number of analysed new started processes analysed:12
                                                                                                        Number of new started drivers analysed:0
                                                                                                        Number of existing processes analysed:0
                                                                                                        Number of existing drivers analysed:0
                                                                                                        Number of injected processes analysed:0
                                                                                                        Technologies:
                                                                                                        • HCA enabled
                                                                                                        • EGA enabled
                                                                                                        • AMSI enabled
                                                                                                        Analysis Mode:default
                                                                                                        Analysis stop reason:Timeout
                                                                                                        Sample name:xSO7sbN2j6.exe
                                                                                                        (renamed file extension from none to exe, renamed because original name is a hash value)
                                                                                                        Original Sample Name:95256b28dfb85f1d5bafdec109950775733d4af82acc0512151639695c57e469
                                                                                                        Detection:MAL
                                                                                                        Classification:mal100.evad.winEXE@8/83@0/0
                                                                                                        EGA Information:
                                                                                                        • Successful, ratio: 100%
                                                                                                        HCA Information:
                                                                                                        • Successful, ratio: 97%
                                                                                                        • Number of executed functions: 76
                                                                                                        • Number of non-executed functions: 139

                                                                                                        Warnings

                                                                                                        • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, WmiApSrv.exe, WmiPrvSE.exe, svchost.exe
                                                                                                        • Excluded IPs from analysis (whitelisted): 40.126.29.6, 40.126.29.14, 40.126.29.10, 40.126.29.9, 40.126.29.12, 40.126.29.5, 40.126.29.8, 40.126.29.7, 20.42.73.29
                                                                                                        • Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, slscr.update.microsoft.com, www.tm.v4.a.prd.aadg.trafficmanager.net, ctldl.windowsupdate.com, dns.msftncsi.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, ocsp.edge.digicert.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, umwatson.events.data.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net
                                                                                                        • Not all processes where analyzed, report is missing behavior information
                                                                                                        • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                        • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                        • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                        • Report size getting too big, too many NtQueryValueKey calls found.

                                                                                                        Simulations

                                                                                                        Behavior and APIs

                                                                                                        ⊘No simulations

                                                                                                        Joe Sandbox View / Context

                                                                                                        IPs

                                                                                                        ⊘No context

                                                                                                        Domains

                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                        fp2e7a.wpc.phicdn.nethttps://aeno.co.jp.talglfts.cc/aeonGet hashmaliciousUnknownBrowse
                                                                                                        • 192.229.211.108
                                                                                                        https://scsang.cn/Get hashmaliciousUnknownBrowse
                                                                                                        • 192.229.211.108
                                                                                                        https://cvn7.sa.com/invoice.html?app=Get hashmaliciousHTMLPhisherBrowse
                                                                                                        • 192.229.211.108
                                                                                                        https://setteledpaineter.uk.nf/Get hashmaliciousUnknownBrowse
                                                                                                        • 192.229.211.108
                                                                                                        https://zmmzmnsnnbxbbxvcxv22.z13.web.core.windows.net/Get hashmaliciousUnknownBrowse
                                                                                                        • 192.229.211.108
                                                                                                        https://dev217.d3uf3ys8fxt6s2.amplifyapp.com/Win08ShDMeEr0887/index.htmlGet hashmaliciousUnknownBrowse
                                                                                                        • 192.229.211.108
                                                                                                        https://www.huiyuan-sh.com/Get hashmaliciousUnknownBrowse
                                                                                                        • 192.229.211.108
                                                                                                        https://sdcoes.net/LandingPage/Index/122/Get hashmaliciousHTMLPhisherBrowse
                                                                                                        • 192.229.211.108
                                                                                                        https://appddd08.z19.web.core.windows.net/Win0security-helpline07/index.html?ph0n=1-844-492-0415Get hashmaliciousTechSupportScamBrowse
                                                                                                        • 192.229.211.108
                                                                                                        https://6a5ff6af4b0fe3e6f0bd452927dfb55b352fdd2d1bab6d1e7de2b641e2.pages.dev/Get hashmaliciousHTMLPhisherBrowse
                                                                                                        • 192.229.211.108

                                                                                                        ASNs

                                                                                                        ⊘No context

                                                                                                        JA3 Fingerprints

                                                                                                        ⊘No context

                                                                                                        Dropped Files

                                                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                        C:\Users\user\AppData\Local\Temp\_MEI12682\MSVCP140.dllSecuriteInfo.com.Win64.Evo-gen.32634.31069.exeGet hashmaliciousLummaC, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro StealerBrowse
                                                                                                          whisper-faster.exeGet hashmaliciousUnknownBrowse
                                                                                                            whisper-faster.exeGet hashmaliciousUnknownBrowse
                                                                                                              webex.exeGet hashmaliciousUnknownBrowse
                                                                                                                webex.exeGet hashmaliciousUnknownBrowse
                                                                                                                  ZzutQz4T6D.exeGet hashmaliciousMars Stealer, Stealc, VidarBrowse
                                                                                                                    webex.exeGet hashmaliciousUnknownBrowse
                                                                                                                      webex.exeGet hashmaliciousUnknownBrowse
                                                                                                                        Create_Installer_PLC0000037_2024_English_WIN64.exeGet hashmaliciousUnknownBrowse
                                                                                                                          webex.exeGet hashmaliciousUnknownBrowse
                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI12682\Pythonwin\mfc140u.dllSecuriteInfo.com.Win64.Evo-gen.32634.31069.exeGet hashmaliciousLummaC, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro StealerBrowse
                                                                                                                              Sp#U251c#U0434ti.exeGet hashmaliciousUnknownBrowse
                                                                                                                                cc.exeGet hashmaliciousUnknownBrowse
                                                                                                                                  https://developers.yubico.com/yubikey-manager-qt/Releases/yubikey-manager-qt-1.2.6-win64.exeGet hashmaliciousUnknownBrowse
                                                                                                                                    valoranthack.exeGet hashmaliciousLuna LoggerBrowse
                                                                                                                                      r0gv5UI76Q.exeGet hashmaliciousUnknownBrowse
                                                                                                                                        ip_new.exeGet hashmaliciousUnknownBrowse
                                                                                                                                          thurs20.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                            thurs17.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                              thurs21.exeGet hashmaliciousPython StealerBrowse

                                                                                                                                                Created / dropped Files

                                                                                                                                                C:\Users\user\AppData\Local\Temp\0muh7zmj

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:ASCII text, with no line terminators
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):4
                                                                                                                                                Entropy (8bit):2.0
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:3:qn:qn
                                                                                                                                                MD5:3F1D1D8D87177D3D8D897D7E421F84D6
                                                                                                                                                SHA1:DD082D742A5CB751290F1DB2BD519C286AA86D95
                                                                                                                                                SHA-256:F02285FB90ED8C81531FE78CF4E2ABB68A62BE73EE7D317623E2C3E3AEFDFFF2
                                                                                                                                                SHA-512:2AE2B3936F31756332CA7A4B877D18F3FCC50E41E9472B5CD45A70BEA82E29A0FA956EE6A9EE0E02F23D9DB56B41D19CB51D88AAC06E9C923A820A21023752A9
                                                                                                                                                Malicious:false
                                                                                                                                                Reputation:moderate, very likely benign file
                                                                                                                                                Preview:blat

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\MSVCP140.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):578384
                                                                                                                                                Entropy (8bit):6.524580849411757
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:12288:RBSNvy11qsslnxU/1ceqHiNHlOp/2M+UHHZpDLO+r2VhQEKZm+jWodEEVAdm:RBSDOFQEKZm+jWodEE2dm
                                                                                                                                                MD5:1BA6D1CF0508775096F9E121A24E5863
                                                                                                                                                SHA1:DF552810D779476610DA3C8B956CC921ED6C91AE
                                                                                                                                                SHA-256:74892D9B4028C05DEBAF0B9B5D9DC6D22F7956FA7D7EEE00C681318C26792823
                                                                                                                                                SHA-512:9887D9F5838AA1555EA87968E014EDFE2F7747F138F1B551D1F609BC1D5D8214A5FDAB0D76FCAC98864C1DA5EB81405CA373B2A30CB12203C011D89EA6D069AF
                                                                                                                                                Malicious:false
                                                                                                                                                Antivirus:
                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                Joe Sandbox View:
                                                                                                                                                • Filename: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, Detection: malicious, Browse
                                                                                                                                                • Filename: whisper-faster.exe, Detection: malicious, Browse
                                                                                                                                                • Filename: whisper-faster.exe, Detection: malicious, Browse
                                                                                                                                                • Filename: webex.exe, Detection: malicious, Browse
                                                                                                                                                • Filename: webex.exe, Detection: malicious, Browse
                                                                                                                                                • Filename: ZzutQz4T6D.exe, Detection: malicious, Browse
                                                                                                                                                • Filename: webex.exe, Detection: malicious, Browse
                                                                                                                                                • Filename: webex.exe, Detection: malicious, Browse
                                                                                                                                                • Filename: Create_Installer_PLC0000037_2024_English_WIN64.exe, Detection: malicious, Browse
                                                                                                                                                • Filename: webex.exe, Detection: malicious, Browse
                                                                                                                                                Reputation:moderate, very likely benign file
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."...f..f..f.....d..o.A.p..f........c.....n.....b...........g....-.g.....g..Richf..........................PE..d................." ...$.F...V......`1....................................................`A........................................PB..h.......,................9......PO......8...p...p...........................0...@............`...............................text....E.......F.................. ..`.rdata.......`.......J..............@..@.data....8...@......................@....pdata...9.......:...<..............@..@.rsrc................v..............@..@.reloc..8............z..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\Pythonwin\mfc140u.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):5653424
                                                                                                                                                Entropy (8bit):6.729277267882055
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:49152:EuEsNcEc8/CK4b11P5ViH8gw0+NVQD5stWIlE7lva8iposS9j5fzSQzs7ID+AVuS:EnL8+5fiEnQFLOAkGkzdnEVomFHKnPS
                                                                                                                                                MD5:03A161718F1D5E41897236D48C91AE3C
                                                                                                                                                SHA1:32B10EB46BAFB9F81A402CB7EFF4767418956BD4
                                                                                                                                                SHA-256:E06C4BD078F4690AA8874A3DEB38E802B2A16CCB602A7EDC2E077E98C05B5807
                                                                                                                                                SHA-512:7ABCC90E845B43D264EE18C9565C7D0CBB383BFD72B9CEBB198BA60C4A46F56DA5480DA51C90FF82957AD4C84A4799FA3EB0CEDFFAA6195F1315B3FF3DA1BE47
                                                                                                                                                Malicious:false
                                                                                                                                                Antivirus:
                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                Joe Sandbox View:
                                                                                                                                                • Filename: SecuriteInfo.com.Win64.Evo-gen.32634.31069.exe, Detection: malicious, Browse
                                                                                                                                                • Filename: Sp#U251c#U0434ti.exe, Detection: malicious, Browse
                                                                                                                                                • Filename: cc.exe, Detection: malicious, Browse
                                                                                                                                                • Filename: , Detection: malicious, Browse
                                                                                                                                                • Filename: valoranthack.exe, Detection: malicious, Browse
                                                                                                                                                • Filename: r0gv5UI76Q.exe, Detection: malicious, Browse
                                                                                                                                                • Filename: ip_new.exe, Detection: malicious, Browse
                                                                                                                                                • Filename: thurs20.exe, Detection: malicious, Browse
                                                                                                                                                • Filename: thurs17.exe, Detection: malicious, Browse
                                                                                                                                                • Filename: thurs21.exe, Detection: malicious, Browse
                                                                                                                                                Reputation:moderate, very likely benign file
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.cu...&...&...&...'...&...'...&...'...&..&...&G..'...&G..'...&...'...&...&..&G..'...&G..'...&G..'...&G..'...&G..&...&G..'...&Rich...&................PE..d....~.a.........." .....(-..X)......X,.......................................V......YV...`A..........................................:.....h.;.......?......`=..8....V..'...PU.0p..p.5.T...........................`...8............@-.P...0.:......................text....&-......(-................. ..`.rdata.......@-......,-.............@..@.data....6... <.......<.............@....pdata...8...`=..:....<.............@..@.didat..H.....?.......?.............@....rsrc.........?.......?.............@..@.reloc..0p...PU..r....T.............@..B................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\Pythonwin\win32ui.pyd

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):290304
                                                                                                                                                Entropy (8bit):7.872892408480815
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:6144:CQrI4a86uBgv9Y6z8fd8SFzaYiYAJn9Q0B5e4zEONlM+chlkCb8JrRikP9:CQLXfEgdmBjn9X3EONS/YCq1P
                                                                                                                                                MD5:376C58A0C1A4B549AA7E05759AB1B16E
                                                                                                                                                SHA1:732C31C2A945704ADE1D4D718D11FAC49D0B3CC6
                                                                                                                                                SHA-256:E7443391287D86FB914613FF642F45AD3A106A967C3C26FF8F0AF1B117E13EFB
                                                                                                                                                SHA-512:795CCFC345EC6D09E43E831CC58ED382BFB3C3688C086E2BAD49434484C9937D25EA51BF1FF137F50FE6C6B7B9E5364282ECCFF07E3A25C472FF23EDD7779D6D
                                                                                                                                                Malicious:false
                                                                                                                                                Antivirus:
                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                Reputation:low
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........|.F..r...r...r..e....r."hs...r..{s...r..vs...r..hv...r..hq...r..hw...r...s...r..hs...r."h{...r."hr...r."h....r."hp...r.Rich..r.........................PE..d......d.........." ................0........................................`............`..............................................T..4...........48... ...............P.. ...........................P...(.......8...........................................UPX0....................................UPX1................................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\VCRUNTIME140.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):96120
                                                                                                                                                Entropy (8bit):6.440691568981583
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:1536:dkb0wrlWxdV4tyfa/PUFSAM/HQUucN2f0MFOqH+F3fecbTUEuvw:dWD4eUp+HQpcNg0MFnH+F3fecbTUED
                                                                                                                                                MD5:4A365FFDBDE27954E768358F4A4CE82E
                                                                                                                                                SHA1:A1B31102EEE1D2A4ED1290DA2038B7B9F6A104A3
                                                                                                                                                SHA-256:6A0850419432735A98E56857D5CFCE97E9D58A947A9863CA6AFADD1C7BCAB27C
                                                                                                                                                SHA-512:54E4B6287C4D5A165509047262873085F50953AF63CA0DCB7649C22ABA5B439AB117A7E0D6E7F0A3E51A23E28A255FFD1CA1DDCE4B2EA7F87BCA1C9B0DBE2722
                                                                                                                                                Malicious:false
                                                                                                                                                Antivirus:
                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........~.[...[...[.......Y...R...P...[...w.......V.......K.......D.......Z......Z.......Z...Rich[...................PE..d....R^`.........." .........^......`.....................................................`A.........................................A..4....I...............`..L....T..x#..........H,..T............................,..8............................................text............................... ..`.rdata...?.......@..................@..@.data...@....P.......<..............@....pdata..L....`.......@..............@..@_RDATA.......p.......L..............@..@.rsrc................N..............@..@.reloc...............R..............@..B........................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\VCRUNTIME140_1.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):36728
                                                                                                                                                Entropy (8bit):6.340048377061949
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:384:nNn62MCmWEPhUcSLt5a9Y6v4HOE5fY/ntz5BBW0O3+XfeuncS79+pWrQKWhD/HRj:YdCm5PhUcxgHY/ntXBzxvV7KtDvCTO
                                                                                                                                                MD5:9CFF894542DC399E0A46DEE017331EDF
                                                                                                                                                SHA1:D1E889D22A5311BD518517537CA98B3520FC99FF
                                                                                                                                                SHA-256:B1D3B6B3CDEB5B7B8187767CD86100B76233E7BBB9ACF56C64F8288F34B269CA
                                                                                                                                                SHA-512:CA254231F12BDFC300712A37D31777FF9D3AA990CCC129129FA724B034F3B59C88ED5006A5F057348FA09A7DE4A0C2E0FB479CE06556E2059F919DDD037F239E
                                                                                                                                                Malicious:false
                                                                                                                                                Antivirus:
                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........k...8...8...8@..9...8}..9...8.._8...8...8...8}..9...8}..9...8}..9...8}..9...8}.38...8}..9...8Rich...8........PE..d....R^`.........." .....:...4......`A....................................................`A.........................................k......<l..x....................l..x#......<...(b..T............................b..8............P..X............................text...u9.......:.................. ..`.rdata..P!...P..."...>..............@..@.data... ............`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..<............j..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\_bz2.pyd

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):47792
                                                                                                                                                Entropy (8bit):7.759135237425322
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:768:fSt1pAaIL2thxk3rjQgofeVaIqCGoDFQ7yqnuIJ7TpcgIIMVGpDG4yAehFj:C1pAaIaes3feV1iizgIIMVGry7
                                                                                                                                                MD5:5F464B4F06DFE3AB504169FFDC7F53AE
                                                                                                                                                SHA1:2942CF1F492213842D7BB8E8198355D3607B2F3B
                                                                                                                                                SHA-256:0DD68268A9D47CE935FF932C3FE281E7A6D57E9CD424299D05560E56A773EF4B
                                                                                                                                                SHA-512:D66C3C238A1EBDFB6F81436F8D0481F3ED8A0FF1212E3EFE466D6820E36DB50C31DCDB1019E46DCEDB753149A6CEF3F9485FC232F3DD42B96B7B0604DBAD6040
                                                                                                                                                Malicious:false
                                                                                                                                                Antivirus:
                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                • Antivirus: Virustotal, Detection: 1%, Browse
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[..>...m...m...m...m...ms..l...my.bm...ms..l...ms..l...ms..l...m..l...mD..l...m...m~..m..l...m..l...m.`m...m..l...mRich...m........................PE..d.....`.........." ..................... ................................................`.........................................`...H......|............P..4.......................................................8...........................................UPX0....................................UPX1......... ......................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\_ctypes.pyd

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):58032
                                                                                                                                                Entropy (8bit):7.837553293459017
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:1536:GCwIk2ERK2HZqd6d93oXrCedXfxsYazzIIBPt0yzl:GHTPok3oXr5dvxsYafIIBPtbl
                                                                                                                                                MD5:332D773008E12399AB98D085CD60C583
                                                                                                                                                SHA1:C3AA78E9BA7732B989A3CAB996E63791EAF46A7F
                                                                                                                                                SHA-256:19B813BCD356F37E73FE7D367051EB0BD901F2BD14CA8AD4662B1503B1459CEA
                                                                                                                                                SHA-512:381C2083CCFDB39F3986060B21FF168EE87CFAFC4AD53B34DE3AE473A4FC0204615AF87E9EE69407D07528064C7B2A7D9F23A94939DE0E26C614169B8CC418AA
                                                                                                                                                Malicious:false
                                                                                                                                                Antivirus:
                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                • Antivirus: Virustotal, Detection: 1%, Browse
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........t....x...x...x..m...x..ay...x..a}...x..a|...x..a{...x..ay...x..}|...x..}y...x.@|y...x...y.?.x..au...x..ax...x..a....x..az...x.Rich..x.................PE..d...|.`.........." ................ F.......................................p............`..........................................l.......i.......`.......................m......................................0R..8...........................................UPX0....................................UPX1................................@....rsrc........`......................@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\_elementtree.pyd

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):78512
                                                                                                                                                Entropy (8bit):7.903168272994478
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:1536:Ss4deEa1XFe+dq9uHZH6FMpNCL51ngCDVWNSIIkftTy5:wdrAZdj5aOpNCrnBWoIIkfto
                                                                                                                                                MD5:5F8A8DA577CE431C77F5D4B8F972E5E0
                                                                                                                                                SHA1:23306304175383DE4C6E039C9A106000BB28DA31
                                                                                                                                                SHA-256:5A32E12FDE1F4E8A805D598E6CFBEC1E4AEAA9F9C1744BC3B1BF8B2AB9706686
                                                                                                                                                SHA-512:1438C0DD7881CA76CCBCEAB054413C3E08EA373ECF6A109C9C1F4896585B5F12B0FBC9E954EB5DBAABDED498DF713FE96555A8ED861707982DC46D603363F939
                                                                                                                                                Malicious:false
                                                                                                                                                Antivirus:
                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                • Antivirus: Virustotal, Detection: 1%, Browse
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......aG.M%&..%&..%&..,^d.)&..IR..'&..IR...&..IR..-&..IR..&&...R..'&..~N..&&..%&...&...R..!&...R..$&...R..$&...R..$&..Rich%&..................PE..d...n.`.........." .........................................................0............`..........................................,..X....)....... ..........x...........(-..........................................8...........................................UPX0....................................UPX1................................@....rsrc........ ......................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\_hashlib.pyd

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):28336
                                                                                                                                                Entropy (8bit):7.503409203437653
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:384:EpNTVr+yTLZuSNa0x/iwRvz4SQ1ilQYHTMN6RoZa7gJX78IIYILyDG4y8XRShMpp:EpN7/dKwCSQoMppr8IIYILyDG4ybhMD
                                                                                                                                                MD5:7A323C4FCE36AB53DA167E4074A68A77
                                                                                                                                                SHA1:78A0E1EBBC7B357DBD37FCEE32589C4D0DC94DFE
                                                                                                                                                SHA-256:07419B0862EDABE485317C199EE61B4DE838EC730789B12B8D660B6A1E5AAF76
                                                                                                                                                SHA-512:8DAD82FA63917FF035271E8ED73C9F2ECDF5414E98D48A144F302C68CB16EA6D8DACF4FBFE11458B5D78715089EBAA45CD157AD53FB7989FD2FA81AFCE39E49A
                                                                                                                                                Malicious:false
                                                                                                                                                Antivirus:
                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........?...^..^..^..&e.^...*..^...*..^...*..^...*..^..U*..^...6..^..)7..^..^...^..U*..^..U*..^..U*..^..U*..^..Rich.^..........................PE..d.....`.........." .....@................................................................`.............................................P...............................................................................8...........................................UPX0....................................UPX1.....@.......@..................@....rsrc................D..............@......................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\_lzma.pyd

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):86704
                                                                                                                                                Entropy (8bit):7.922392665313969
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:1536:r1mzwAeL7Ij2wtqklnNNxP/SxbtYOndQqUAVGd+fP3S+9kAUmIID1tmyPx:Io3wDNNxP/6btYUUEGd+HTPVIID1tNx
                                                                                                                                                MD5:6CF80DCA091DAD17790A6B1AF4E85381
                                                                                                                                                SHA1:BCB4052A4F960B429EB9DB019734FC00B41C4427
                                                                                                                                                SHA-256:2B41390D1BFFA9C5B7018BC0544B0A2C188ECB9B00EBC56DF5A864DC47E32697
                                                                                                                                                SHA-512:DA00F86C7A4168FA46FAEC79605831D26E4C86DD1D009B89F5087AC756BDFC32E0C036471639131EB881BCC53B8F1F92D947F3EF47F3DC7E56BB2E99D1357CF3
                                                                                                                                                Malicious:false
                                                                                                                                                Antivirus:
                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                • Antivirus: Virustotal, Detection: 4%, Browse
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Q...0.C.0.C.0.C.HOC.0.C.D.B.0.C.D.B.0.C.D.B.0.C.D.B.0.C>D.B.0.C.X.B.0.C.0.C.0.C>D.B.0.C>D.B.0.C>D#C.0.C>D.B.0.CRich.0.C........................PE..d.....`.........." .....0.......... .....................................................`.........................................|...L....................`...................................................... ...8...........................................UPX0....................................UPX1.....0.......&..................@....rsrc................*..............@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\_queue.pyd

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):22704
                                                                                                                                                Entropy (8bit):7.303940313534979
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:384:LubMpgolBKHStjxZHfdqWQ6Za7gJXW5IImUbMvkDG4y8e8C97hP:wM5Bzjj/dp9pm5IImUbMsDG4yaC97hP
                                                                                                                                                MD5:7A9EAB9B45B38B485AD540FCD60FD1C2
                                                                                                                                                SHA1:8FC5679207187B8E37F73C3826A0F1CEF06BC7D9
                                                                                                                                                SHA-256:3E97629DB46D159DB614A2AF447A8FCD3CDEA807D7BDB8B32ADADB372B8ED3AE
                                                                                                                                                SHA-512:1FA6745B5B9444D9AFEE8E8852B8BAF6790C40D6AF9C8ACE0AA5B5A242C1825CF7EEE467515270C55833D11878B1D6E36E67AAD3090A2BD7D504F8CC75D3E81D
                                                                                                                                                Malicious:false
                                                                                                                                                Antivirus:
                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                • Antivirus: Virustotal, Detection: 1%, Browse
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........%a.ZD..ZD..ZD..S<..XD..60..XD..60..QD..60..RD..60..YD..0..YD...,..XD..ZD...D..0..[D..0..[D..0..[D..0..[D..RichZD..........PE..d...o.`.........." .....0.......... .....................................................`.........................................8...L.......P............`..0................................................... ...8...........................................UPX0....................................UPX1.....0.......,..................@....rsrc................0..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\_socket.pyd

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):41136
                                                                                                                                                Entropy (8bit):7.669436133022269
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:768:Y2N9l9nLOO9DF7h5c5pZEVLxWQ+rHqKw1pAT9IIBwmS3F94DG4ytU9h/:PNZnv9c5p40KgT9IIBwmA4yin
                                                                                                                                                MD5:15A40AFE3A6A996DA1ED9C9EB13362B8
                                                                                                                                                SHA1:FB7A8827FD244642A1BDA9E863E8A1137A791554
                                                                                                                                                SHA-256:55C9F10D31037738DA2110BB88074CF4B6D65E256C9411560000330ED27704C1
                                                                                                                                                SHA-512:F75213237180FE0395908F5E272217F8287A19083A00D23C5934061F27E07E00B5130CCD44453C2633B2406433D3E537F45923E4712EF420BB60CC9307030990
                                                                                                                                                Malicious:false
                                                                                                                                                Antivirus:
                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                • Antivirus: Virustotal, Detection: 1%, Browse
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<.......<...=...<...9...<...8...<...?...<.'.=...<...=...<...=.I.<.'.1...<.'.<...<.'....<.'.>...<.Rich..<.................PE..d.....`.........." .................r....................................................`............................................P...................0..8...........@... ....................................~..8...........................................UPX0....................................UPX1.............r..................@....rsrc................v..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\_ssl.pyd

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):59056
                                                                                                                                                Entropy (8bit):7.8302873217993465
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:1536:kMAft6h1P/xN70ArkFOwFU3Q6ji9OaIIM7dU40y8j:kM0t81BhrkQwU3g9vIIM7dc
                                                                                                                                                MD5:A61613B2A31FB6C1D0F11A2AB42C3A9E
                                                                                                                                                SHA1:A51069C3AEB3C7C8D802CF076005B1C1717CA12A
                                                                                                                                                SHA-256:1B39EAC9D666211E670E37420D9FD43516695E7EF53832F4DBD86B6E97FC9BF3
                                                                                                                                                SHA-512:A35283C7FB47E79580917252CB08329C5F302A77322FFD8A0FE5CD8C081130C5FA28C5E7EB3D7EB8C6D0DCA25A7D423CB303AB2EC82296EAC41C91E38369CCAF
                                                                                                                                                Malicious:false
                                                                                                                                                Antivirus:
                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4b{.p...p...p...y{..v....w..r....w..|....w..x....w..s....w..r....j..t...+k..w...p........w..r....w..q....w.q....w..q...Richp...........PE..d.....`.........." ......................................................................`.............................................d....................@..........................................................8...........................................UPX0....................................UPX1................................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-console-l1-1-0.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):12240
                                                                                                                                                Entropy (8bit):6.608323768366966
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:192:KFOWWthWzWf9BvVVWQ4mWqyVT/gqnajKsrCS81:uZWthWeN01IlGsrCt
                                                                                                                                                MD5:07EBE4D5CEF3301CCF07430F4C3E32D8
                                                                                                                                                SHA1:3B878B2B2720915773F16DBA6D493DAB0680AC5F
                                                                                                                                                SHA-256:8F8B79150E850ACC92FD6AAB614F6E3759BEA875134A62087D5DD65581E3001F
                                                                                                                                                SHA-512:6C7E4DF62EBAE9934B698F231CF51F54743CF3303CD758573D00F872B8ECC2AF1F556B094503AAE91100189C0D0A93EAF1B7CAFEC677F384A1D7B4FDA2EEE598
                                                                                                                                                Malicious:false
                                                                                                                                                Antivirus:
                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d................." .........................................................0............`A........................................p...,............ ...................!..............p............................................................................rdata..d...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-datetime-l1-1-0.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):11736
                                                                                                                                                Entropy (8bit):6.6074868843808785
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:192:PUWthW6Wf9BvVVWQ4SWZifvXqnajJ6HNbLet:MWthW3NhXll6HZm
                                                                                                                                                MD5:557405C47613DE66B111D0E2B01F2FDB
                                                                                                                                                SHA1:DE116ED5DE1FFAA900732709E5E4EEF921EAD63C
                                                                                                                                                SHA-256:913EAAA7997A6AEE53574CFFB83F9C9C1700B1D8B46744A5E12D76A1E53376FD
                                                                                                                                                SHA-512:C2B326F555B2B7ACB7849402AC85922880105857C616EF98F7FB4BBBDC2CD7F2AF010F4A747875646FCC272AB8AA4CE290B6E09A9896CE1587E638502BD4BEFB
                                                                                                                                                Malicious:false
                                                                                                                                                Antivirus:
                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...p.~..........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..H...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-debug-l1-1-0.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):11728
                                                                                                                                                Entropy (8bit):6.622854484071805
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:192:tlWthWFWf9BvVVWQ4mWIzWLiP+CjAWqnajKsNb7:/WthWANnWLiP+CcWlGsNb7
                                                                                                                                                MD5:624401F31A706B1AE2245EB19264DC7F
                                                                                                                                                SHA1:8D9DEF3750C18DDFC044D5568E3406D5D0FB9285
                                                                                                                                                SHA-256:58A8D69DF60ECBEE776CD9A74B2A32B14BF2B0BD92D527EC5F19502A0D3EB8E9
                                                                                                                                                SHA-512:3353734B556D6EEBC57734827450CE3B34D010E0C033E95A6E60800C0FDA79A1958EBF9053F12054026525D95D24EEC541633186F00F162475CEC19F07A0D817
                                                                                                                                                Malicious:false
                                                                                                                                                Antivirus:
                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...YJ..........." .........................................................0.......s....`A........................................p................ ...................!..............p............................................................................rdata..T...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-errorhandling-l1-1-0.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):11728
                                                                                                                                                Entropy (8bit):6.670771733256744
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:192:1mxD3+HWthWiWf9BvVVWQ4WWuhD7DiqnajKswz3:19HWthWfN/GlGswz3
                                                                                                                                                MD5:2DB5666D3600A4ABCE86BE0099C6B881
                                                                                                                                                SHA1:63D5DDA4CEC0076884BC678C691BDD2A4FA1D906
                                                                                                                                                SHA-256:46079C0A1B660FC187AAFD760707F369D0B60D424D878C57685545A3FCE95819
                                                                                                                                                SHA-512:7C6E1E022DB4217A85A4012C8E4DAEE0A0F987E4FBA8A4C952424EF28E250BAC38B088C242D72B4641157B7CC882161AEFA177765A2E23AFCDC627188A084345
                                                                                                                                                Malicious:false
                                                                                                                                                Antivirus:
                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....^[..........." .........................................................0......@^....`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-file-l1-1-0.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):15328
                                                                                                                                                Entropy (8bit):6.561472518225768
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:192:RaNYPvVX8rFTsoWthWgWf9BvVVWQ4SWfMaPOoI80Hy5qnajslBE87QyX:HPvVXqWthWlN2WlslEE87Qw
                                                                                                                                                MD5:0F7D418C05128246AFA335A1FB400CB9
                                                                                                                                                SHA1:F6313E371ED5A1DFFE35815CC5D25981184D0368
                                                                                                                                                SHA-256:5C9BC70586AD538B0DF1FCF5D6F1F3527450AE16935AA34BD7EB494B4F1B2DB9
                                                                                                                                                SHA-512:7555D9D3311C8622DF6782748C2186A3738C4807FC58DF2F75E539729FC4069DB23739F391950303F12E0D25DF9F065B4C52E13B2EBB6D417CA4C12CFDECA631
                                                                                                                                                Malicious:false
                                                                                                                                                Antivirus:
                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...*.;A.........." .........................................................@.......m....`A........................................p................0...................!..............p............................................................................rdata..<...........................@..@.rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-file-l1-2-0.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):11728
                                                                                                                                                Entropy (8bit):6.638884356866373
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:192:jlWaWthWAWf9BvVVWQ4WWloprVP+CjAWqnajKsNWqL:jIaWthWFNxtVP+CcWlGsNxL
                                                                                                                                                MD5:5A72A803DF2B425D5AAFF21F0F064011
                                                                                                                                                SHA1:4B31963D981C07A7AB2A0D1A706067C539C55EC5
                                                                                                                                                SHA-256:629E52BA4E2DCA91B10EF7729A1722888E01284EED7DDA6030D0A1EC46C94086
                                                                                                                                                SHA-512:BF44997C405C2BA80100EB0F2FF7304938FC69E4D7AE3EAC52B3C236C3188E80C9F18BDA226B5F4FDE0112320E74C198AD985F9FFD7CEA99ACA22980C39C7F69
                                                                                                                                                Malicious:false
                                                                                                                                                Antivirus:
                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...=+vj.........." .........................................................0.......N....`A........................................p...L............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-file-l2-1-0.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):11744
                                                                                                                                                Entropy (8bit):6.744400973311854
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:96:imdzvQzEWthWwMVDEs3f0DHDsVBIwgmqvrnDD0ADEs3TDL2L4m2grMWaLN5DEs3r:v3WthWyWf9BvVVWQ4SWVVFJqqnajW2y
                                                                                                                                                MD5:721B60B85094851C06D572F0BD5D88CD
                                                                                                                                                SHA1:4D0EE4D717AEB9C35DA8621A545D3E2B9F19B4E7
                                                                                                                                                SHA-256:DAC867476CAA42FF8DF8F5DFE869FFD56A18DADEE17D47889AFB69ED6519AFBF
                                                                                                                                                SHA-512:430A91FCECDE4C8CC4AC7EB9B4C6619243AB244EE88C34C9E93CA918E54BD42B08ACA8EA4475D4C0F5FA95241E4AACB3206CBAE863E92D15528C8E7C9F45601B
                                                                                                                                                Malicious:false
                                                                                                                                                Antivirus:
                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d..............." .........................................................0......T`....`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-handle-l1-1-0.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):11736
                                                                                                                                                Entropy (8bit):6.638488013343178
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:192:frWthWFWf9BvVVWQ4SWNOfvXqnajJ6H4WJ:frWthWANRXll6H4WJ
                                                                                                                                                MD5:D1DF480505F2D23C0B5C53DF2E0E2A1A
                                                                                                                                                SHA1:207DB9568AFD273E864B05C87282987E7E81D0BA
                                                                                                                                                SHA-256:0B3DFB8554EAD94D5DA7859A12DB353942406F9D1DFE3FAC3D48663C233EA99D
                                                                                                                                                SHA-512:F14239420F5DD84A15FF5FCA2FAD81D0AA9280C566FA581122A018E10EBDF308AC0BF1D3FCFC08634C1058C395C767130C5ABCA55540295C68DF24FFD931CA0A
                                                                                                                                                Malicious:false
                                                                                                                                                Antivirus:
                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....(..........." .........................................................0......;.....`A........................................p...`............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-heap-l1-1-0.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):12256
                                                                                                                                                Entropy (8bit):6.588267640761022
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:192:txlkWthW2Wf9BvVVWQ4SWBBBuUgxfzfqnaj0OTWv:txlkWthW7NkIrloFv
                                                                                                                                                MD5:73433EBFC9A47ED16EA544DDD308EAF8
                                                                                                                                                SHA1:AC1DA1378DD79762C6619C9A63FD1EBE4D360C6F
                                                                                                                                                SHA-256:C43075B1D2386A8A262DE628C93A65350E52EAE82582B27F879708364B978E29
                                                                                                                                                SHA-512:1C28CC0D3D02D4C308A86E9D0BC2DA88333DFA8C92305EC706F3E389F7BB6D15053040AFD1C4F0AA3383F3549495343A537D09FE882DB6ED12B7507115E5A263
                                                                                                                                                Malicious:false
                                                                                                                                                Antivirus:
                                                                                                                                                • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....pi..........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..<...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-interlocked-l1-1-0.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):11728
                                                                                                                                                Entropy (8bit):6.678828474114903
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:192:4TWthWckWf9BvVVWQ4mWQAyUD7DiqnajKswzjdg:4TWthWcRNqGlGswzji
                                                                                                                                                MD5:7C7B61FFA29209B13D2506418746780B
                                                                                                                                                SHA1:08F3A819B5229734D98D58291BE4BFA0BEC8F761
                                                                                                                                                SHA-256:C23FE8D5C3CA89189D11EC8DF983CC144D168CB54D9EAB5D9532767BCB2F1FA3
                                                                                                                                                SHA-512:6E5E3485D980E7E2824665CBFE4F1619B3E61CE3BCBF103979532E2B1C3D22C89F65BCFBDDBB5FE88CDDD096F8FD72D498E8EE35C3C2307BACECC6DEBBC1C97F
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....|............" .........................................................0.......3....`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-libraryloader-l1-1-0.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):12752
                                                                                                                                                Entropy (8bit):6.602852377056617
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:192:Us13vuBL3B5LoWthW7Wf9BvVVWQ4mWgB7OQP+CjAWqnajKsN9arO:Us13vuBL3B2WthWmNVXP+CcWlGsN9P
                                                                                                                                                MD5:6D0550D3A64BD3FD1D1B739133EFB133
                                                                                                                                                SHA1:C7596FDE7EA1C676F0CC679CED8BA810D15A4AFE
                                                                                                                                                SHA-256:F320F9C0463DE641B396CE7561AF995DE32211E144407828B117088CF289DF91
                                                                                                                                                SHA-512:5DA9D490EF54A1129C94CE51349399B9012FC0D4B575AE6C9F1BAFCFCF7F65266F797C539489F882D4AD924C94428B72F5137009A851ECB541FE7FB9DE12FEB2
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...]. ,.........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..X...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-localization-l1-2-0.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):14800
                                                                                                                                                Entropy (8bit):6.528059454770997
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:384:On2OMw3zdp3bwjGfue9/0jCRrndbZWWthWdNHhfVlGsSH:/OMwBprwjGfue9/0jCRrndbLEKv
                                                                                                                                                MD5:1ED0B196AB58EDB58FCF84E1739C63CE
                                                                                                                                                SHA1:AC7D6C77629BDEE1DF7E380CC9559E09D51D75B7
                                                                                                                                                SHA-256:8664222823E122FCA724620FD8B72187FC5336C737D891D3CEF85F4F533B8DE2
                                                                                                                                                SHA-512:E1FA7F14F39C97AAA3104F3E13098626B5F7CFD665BA52DCB2312A329639AAF5083A9177E4686D11C4213E28ACC40E2C027988074B6CC13C5016D5C5E9EF897B
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...w............" .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-memory-l1-1-0.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):12240
                                                                                                                                                Entropy (8bit):6.659218747104705
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:192:2E+tWthWvWf9BvVVWQ4mWxHD7DiqnajKswzGIAf:T+tWthWiNcGlGswzLAf
                                                                                                                                                MD5:721BAEA26A27134792C5CCC613F212B2
                                                                                                                                                SHA1:2A27DCD2436DF656A8264A949D9CE00EAB4E35E8
                                                                                                                                                SHA-256:5D9767D8CCA0FBFD5801BFF2E0C2ADDDD1BAAAA8175543625609ABCE1A9257BD
                                                                                                                                                SHA-512:9FD6058407AA95058ED2FDA9D391B7A35FA99395EC719B83C5116E91C9B448A6D853ECC731D0BDF448D1436382EECC1FA9101F73FA242D826CC13C4FD881D9BD
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...,OT..........." .........................................................0...........`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-namedpipe-l1-1-0.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):11728
                                                                                                                                                Entropy (8bit):6.739082809754283
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:192:vdWthW8Wf9BvVVWQ4mWG2P+CjAWqnajKsNt:lWthWJNUP+CcWlGsNt
                                                                                                                                                MD5:B3F887142F40CB176B59E58458F8C46D
                                                                                                                                                SHA1:A05948ABA6F58EB99BBAC54FA3ED0338D40CBFAD
                                                                                                                                                SHA-256:8E015CDF2561450ED9A0773BE1159463163C19EAB2B6976155117D16C36519DA
                                                                                                                                                SHA-512:7B762319EC58E3FCB84B215AE142699B766FA9D5A26E1A727572EE6ED4F5D19C859EFB568C0268846B4AA5506422D6DD9B4854DA2C9B419BFEC754F547203F7E
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...X.j..........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-processenvironment-l1-1-0.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):12752
                                                                                                                                                Entropy (8bit):6.601112204637961
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:192:GFPWthW5Wf9BvVVWQ4mWc0ZD7DiqnajKswzczr:GFPWthWsNiGlGswzq
                                                                                                                                                MD5:89F35CB1212A1FD8FBE960795C92D6E8
                                                                                                                                                SHA1:061AE273A75324885DD098EE1FF4246A97E1E60C
                                                                                                                                                SHA-256:058EB7CE88C22D2FF7D3E61E6593CA4E3D6DF449F984BF251D9432665E1517D1
                                                                                                                                                SHA-512:F9E81F1FEAB1535128B16E9FF389BD3DAAAB8D1DABF64270F9E563BE9D370C023DE5D5306DD0DE6D27A5A099E7C073D17499442F058EC1D20B9D37F56BCFE6D2
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...ig............" .........................................................0......H.....`A........................................p...H............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-processthreads-l1-1-0.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):14288
                                                                                                                                                Entropy (8bit):6.521808801015781
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:192:/uUk1Jzb9cKcIzWthWzaWf9BvVVWQ4mWmrcLUVT/gqnajKsrCOV:/bk1JzBcKcIzWthWzXNz1IlGsrCOV
                                                                                                                                                MD5:0C933A4B3C2FCF1F805EDD849428C732
                                                                                                                                                SHA1:B8B19318DBB1D2B7D262527ABD1468D099DE3FB6
                                                                                                                                                SHA-256:A5B733E3DCE21AB62BD4010F151B3578C6F1246DA4A96D51AC60817865648DD3
                                                                                                                                                SHA-512:B25ED54345A5B14E06AA9DADD07B465C14C23225023D7225E04FBD8A439E184A7D43AB40DF80E3F8A3C0F2D5C7A79B402DDC6B9093D0D798E612F4406284E39D
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....U..........." .........................................................0......Y.....`A........................................p................ ...................!..............p............................................................................rdata..4...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-processthreads-l1-1-1.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):12240
                                                                                                                                                Entropy (8bit):6.671157737548847
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:192:7oDfIeVWthWZWf9BvVVWQ4mWaHvP+CjAWqnajKsNZ:7oDfIeVWthWMNVP+CcWlGsNZ
                                                                                                                                                MD5:7E8B61D27A9D04E28D4DAE0BFA0902ED
                                                                                                                                                SHA1:861A7B31022915F26FB49C79AC357C65782C9F4B
                                                                                                                                                SHA-256:1EF06C600C451E66E744B2CA356B7F4B7B88BA2F52EC7795858D21525848AC8C
                                                                                                                                                SHA-512:1C5B35026937B45BEB76CB8D79334A306342C57A8E36CC15D633458582FC8F7D9AB70ACE7A92144288C6C017F33ECFC20477A04432619B40A21C9CDA8D249F6D
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d..............." .........................................................0......N.....`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-profile-l1-1-0.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):11728
                                                                                                                                                Entropy (8bit):6.599056003106114
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:192:gR7WthWTVWf9BvVVWQ4mWg2a5P+CjAWqnajKsNQbWl:gVWthWkN/P+CcWlGsNMg
                                                                                                                                                MD5:8D12FFD920314B71F2C32614CC124FEC
                                                                                                                                                SHA1:251A98F2C75C2E25FFD0580F90657A3EA7895F30
                                                                                                                                                SHA-256:E63550608DD58040304EA85367E9E0722038BA8E7DC7BF9D91C4D84F0EC65887
                                                                                                                                                SHA-512:5084C739D7DE465A9A78BCDBB8A3BD063B84A68DCFD3C9EF1BFA224C1CC06580E2A2523FD4696CFC48E9FD068A2C44DBC794DD9BDB43DC74B4E854C82ECD3EA5
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....X4.........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-rtlsupport-l1-1-0.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):12240
                                                                                                                                                Entropy (8bit):6.602527553095181
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:192:zGeVfcWthW+Wf9BvVVWQ4mWMiSID7DiqnajKswz5g:zGeVfcWthWjN6SIGlGswza
                                                                                                                                                MD5:9FA3FC24186D912B0694A572847D6D74
                                                                                                                                                SHA1:93184E00CBDDACAB7F2AD78447D0EAC1B764114D
                                                                                                                                                SHA-256:91508AB353B90B30FF2551020E9755D7AB0E860308F16C2F6417DFB2E9A75014
                                                                                                                                                SHA-512:95AD31C9082F57EA57F5B4C605331FCAD62735A1862AFB01EF8A67FEA4E450154C1AE0C411CF3AC5B9CD35741F8100409CC1910F69C1B2D807D252389812F594
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....P..........." .........................................................0.......`....`A........................................p................ ...................!..............p............................................................................rdata..P...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-string-l1-1-0.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):11728
                                                                                                                                                Entropy (8bit):6.6806369134652055
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:192:qyMv0WthWPWf9BvVVWQ4mWIv/r+YVqnajKsSF:qyMv0WthWCNBfVlGsSF
                                                                                                                                                MD5:C9CBAD5632D4D42A1BC25CCFA8833601
                                                                                                                                                SHA1:09F37353A89F1BFE49F7508559DA2922B8EFEB05
                                                                                                                                                SHA-256:F3A7A9C98EBE915B1B57C16E27FFFD4DDF31A82F0F21C06FE292878E48F5883E
                                                                                                                                                SHA-512:2412E0AFFDC6DB069DE7BD9666B7BAA1CD76AA8D976C9649A4C2F1FFCE27F8269C9B02DA5FD486EC86B54231B1A5EBF6A1C72790815B7C253FEE1F211086892F
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....E.=.........." .........................................................0............`A........................................p................ ...................!..............p............................................................................rdata..,...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-synch-l1-1-0.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):13776
                                                                                                                                                Entropy (8bit):6.573983778839785
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:384:miwidv3V0dfpkXc0vVauzIWthWLN3fVlGsStY:nHdv3VqpkXc0vVaKbiYlY
                                                                                                                                                MD5:4CCDE2D1681217E282996E27F3D9ED2E
                                                                                                                                                SHA1:8EDA134B0294ED35E4BBAC4911DA620301A3F34D
                                                                                                                                                SHA-256:D6708D1254ED88A948871771D6D1296945E1AA3AEB7E33E16CC378F396C61045
                                                                                                                                                SHA-512:93FE6AE9A947AC88CC5ED78996E555700340E110D12B2651F11956DB7CEE66322C269717D31FCCB31744F4C572A455B156B368F08B70EDA9EFFEC6DE01DBAB23
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....k,..........." .........................................................0......3.....`A........................................p...X............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-synch-l1-2-0.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):12240
                                                                                                                                                Entropy (8bit):6.7137872023984055
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:192:TtZ3KjWthWzWf9BvVVWQ4mWXU0P+CjAWqnajKsN2v:TtZ3KjWthWeNwP+CcWlGsNa
                                                                                                                                                MD5:E86CFC5E1147C25972A5EEFED7BE989F
                                                                                                                                                SHA1:0075091C0B1F2809393C5B8B5921586BDD389B29
                                                                                                                                                SHA-256:72C639D1AFDA32A65143BCBE016FE5D8B46D17924F5F5190EB04EFE954C1199A
                                                                                                                                                SHA-512:EA58A8D5AA587B7F5BDE74B4D394921902412617100ED161A7E0BEF6B3C91C5DAE657065EA7805A152DD76992997017E070F5415EF120812B0D61A401AA8C110
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...jN/..........." .........................................................0............`A........................................p...x............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-sysinfo-l1-1-0.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):12768
                                                                                                                                                Entropy (8bit):6.614330511483598
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:192:vgdKIMFYJWthW2Wf9BvVVWQ4SW2zZ7uUgxfzfqnaj0OGWh:0hJWthW7NBzIrloYh
                                                                                                                                                MD5:206ADCB409A1C9A026F7AFDFC2933202
                                                                                                                                                SHA1:BB67E1232A536A4D1AE63370BD1A9B5431335E77
                                                                                                                                                SHA-256:76D8E4ED946DEEFEEFA0D0012C276F0B61F3D1C84AF00533F4931546CBB2F99E
                                                                                                                                                SHA-512:727AA0C4CD1A0B7E2AFFDCED5DA3A0E898E9BAE3C731FF804406AD13864CEE2B27E5BAAC653BAB9A0D2D961489915D4FCAD18557D4383ECB0A066902276955A7
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....~y..........." .........................................................0............`A........................................p...H............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-timezone-l1-1-0.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):12240
                                                                                                                                                Entropy (8bit):6.704366348384627
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:192:Ha2WthWKOWf9BvVVWQ4mWNOrVT/gqnajKsrCkb:Ha2WthWKTNz1IlGsrCo
                                                                                                                                                MD5:91A2AE3C4EB79CF748E15A58108409AD
                                                                                                                                                SHA1:D402B9DF99723EA26A141BFC640D78EAF0B0111B
                                                                                                                                                SHA-256:B0EDA99EABD32FEFECC478FD9FE7439A3F646A864FDAB4EC3C1F18574B5F8B34
                                                                                                                                                SHA-512:8527AF610C1E2101B6F336A142B1A85AC9C19BB3AF4AD4A245CFB6FD602DC185DA0F7803358067099475102F3A8F10A834DC75B56D3E6DED2ED833C00AD217ED
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....%j.........." .........................................................0......|B....`A........................................p...P............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-core-util-l1-1-0.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):11728
                                                                                                                                                Entropy (8bit):6.623077637622405
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:192:jWthWYWf9BvVVWQ4mWd8l1P+CjAWqnajKsNeCw:jWthW9NnP+CcWlGsNex
                                                                                                                                                MD5:1E4C4C8E643DE249401E954488744997
                                                                                                                                                SHA1:DB1C4C0FC907100F204B21474E8CD2DB0135BC61
                                                                                                                                                SHA-256:F28A8FE2CD7E8E00B6D2EC273C16DB6E6EEA9B6B16F7F69887154B6228AF981E
                                                                                                                                                SHA-512:EF8411FD321C0E363C2E5742312CC566E616D4B0A65EFF4FB6F1B22FDBEA3410E1D75B99E889939FF70AD4629C84CEDC88F6794896428C5F0355143443FDC3A3
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d.....R..........." .........................................................0............`A........................................p...<............ ...................!..............p............................................................................rdata..p...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-crt-conio-l1-1-0.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):12752
                                                                                                                                                Entropy (8bit):6.643812426159955
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:192:fSWthWvWf9BvVVWQ4mWFl5P+CjAWqnajKsNifl:aWthWiN+5P+CcWlGsNiN
                                                                                                                                                MD5:FA770BCD70208A479BDE8086D02C22DA
                                                                                                                                                SHA1:28EE5F3CE3732A55CA60AEE781212F117C6F3B26
                                                                                                                                                SHA-256:E677497C1BAEFFFB33A17D22A99B76B7FA7AE7A0C84E12FDA27D9BE5C3D104CF
                                                                                                                                                SHA-512:F8D81E350CEBDBA5AFB579A072BAD7986691E9F3D4C9FEBCA8756B807301782EE6EB5BA16B045CFA29B6E4F4696E0554C718D36D4E64431F46D1E4B1F42DC2B8
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d................" .........................................................0......l.....`A........................................P................ ...................!..............p............................................................................rdata..@...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-crt-convert-l1-1-0.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):15824
                                                                                                                                                Entropy (8bit):6.438848882089563
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:192:yjQ/w8u4cyNWthWYWf9BvVVWQ4mWhu1BVT/gqnajKsrC74m:8yNWthW9Np1IlGsrCEm
                                                                                                                                                MD5:4EC4790281017E616AF632DA1DC624E1
                                                                                                                                                SHA1:342B15C5D3E34AB4AC0B9904B95D0D5B074447B7
                                                                                                                                                SHA-256:5CF5BBB861608131B5F560CBF34A3292C80886B7C75357ACC779E0BF98E16639
                                                                                                                                                SHA-512:80C4E20D37EFF29C7577B2D0ED67539A9C2C228EDB48AB05D72648A6ED38F5FF537715C130342BEB0E3EF16EB11179B9B484303354A026BDA3A86D5414D24E69
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....P............" .........................................................@............`A........................................P................0...................!..............p............................................................................rdata..>...........................@..@.rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-crt-environment-l1-1-0.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):12240
                                                                                                                                                Entropy (8bit):6.6061629057490245
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:192:vWOPWthWAWf9BvVVWQ4mWWbgftmP+CjAWqnajKsNURPblh:BWthWFN+f8P+CcWlGsNURzv
                                                                                                                                                MD5:7A859E91FDCF78A584AC93AA85371BC9
                                                                                                                                                SHA1:1FA9D9CAD7CC26808E697373C1F5F32AAF59D6B7
                                                                                                                                                SHA-256:B7EE468F5B6C650DADA7DB3AD9E115A0E97135B3DF095C3220DFD22BA277B607
                                                                                                                                                SHA-512:A368F21ECA765AFCA86E03D59CF953500770F4A5BFF8B86B2AC53F1B5174C627E061CE9A1F781DC56506774E0D0B09725E9698D4DC2D3A59E93DA7EF3D900887
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...t............." .........................................................0......H.....`A........................................P..."............ ...................!..............p............................................................................rdata..r...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-crt-filesystem-l1-1-0.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):13776
                                                                                                                                                Entropy (8bit):6.65347762698107
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:192:WxSnWlC0i5ClWthWTWf9BvVVWQ4mW+hkKVT/gqnajKsrCw/:WxSnWm5ClWthW+NkK1IlGsrCY
                                                                                                                                                MD5:972544ADE7E32BFDEB28B39BC734CDEE
                                                                                                                                                SHA1:87816F4AFABBDEC0EC2CFEB417748398505C5AA9
                                                                                                                                                SHA-256:7102F8D9D0F3F689129D7FE071B234077FBA4DD3687071D1E2AEAA137B123F86
                                                                                                                                                SHA-512:5E1131B405E0C7A255B1C51073AFF99E2D5C0D28FD3E55CABC04D463758A575A954008EA1BA5B4E2B345B49AF448B93AD21DFC4A01573B3CB6E7256D9ECCEEF1
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...1............" .........................................................0......':....`A........................................P................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-crt-heap-l1-1-0.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):12752
                                                                                                                                                Entropy (8bit):6.58394079658593
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:192:YFY17aFBRQWthWIWf9BvVVWQ4mWHhOP+CjAWqnajKsNngJ:YQtWthWNNdP+CcWlGsNI
                                                                                                                                                MD5:8906279245F7385B189A6B0B67DF2D7C
                                                                                                                                                SHA1:FCF03D9043A2DAAFE8E28DEE0B130513677227E4
                                                                                                                                                SHA-256:F5183B8D7462C01031992267FE85680AB9C5B279BEDC0B25AB219F7C2184766F
                                                                                                                                                SHA-512:67CAC89AE58CC715976107F3BDF279B1E78945AFD07E6F657E076D78E92EE1A98E3E7B8FEAE295AF5CE35E00C804F3F53A890895BADB1EED32377D85C21672B9
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d................." .........................................................0.......l....`A........................................P................ ...................!..............p............................................................................rdata..f...........................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-crt-locale-l1-1-0.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):12240
                                                                                                                                                Entropy (8bit):6.696904963591775
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:192:m8qWthWLWf9BvVVWQ4WWLXlyBZr+YVqnajKsS1:mlWthWWN0uZfVlGsS1
                                                                                                                                                MD5:DD8176E132EEDEA3322443046AC35CA2
                                                                                                                                                SHA1:D13587C7CC52B2C6FBCAA548C8ED2C771A260769
                                                                                                                                                SHA-256:2EB96422375F1A7B687115B132A4005D2E7D3D5DC091FB0EB22A6471E712848E
                                                                                                                                                SHA-512:77CB8C44C8CC8DD29997FBA4424407579AC91176482DB3CF7BC37E1F9F6AA4C4F5BA14862D2F3A9C05D1FDD7CA5A043B5F566BD0E9A9E1ED837DA9C11803B253
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...r..[.........." .........................................................0.......P....`A........................................P...e............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-crt-math-l1-1-0.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):20944
                                                                                                                                                Entropy (8bit):6.216554714002396
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:384:rQM4Oe59Ckb1hgmLRWthW0N0JBJ1IlGsrC5W:sMq59Bb1jYNABHJc
                                                                                                                                                MD5:A6A3D6D11D623E16866F38185853FACD
                                                                                                                                                SHA1:FBEADD1E9016908ECCE5753DE1D435D6FCF3D0B5
                                                                                                                                                SHA-256:A768339F0B03674735404248A039EC8591FCBA6FF61A3C6812414537BADD23B0
                                                                                                                                                SHA-512:ABBF32CEB35E5EC6C1562F9F3B2652B96B7DBD97BFC08D918F987C0EC0503E8390DD697476B2A2389F0172CD8CF16029FD2EC5F32A9BA3688BF2EBEEFB081B2C
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d..............." .........,...............................................P............`A........................................P....%...........@...............0...!..............p............................................................................rdata...&.......(..................@..@.rsrc........@.......,..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-crt-multibyte-l1-1-0.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):19920
                                                                                                                                                Entropy (8bit):6.194200929301547
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:384:8A/kPLPmIHJI6/CpG3t2G3t4odXLRWthW/N5GlGswz3:3/kjPmIHJI6manp3
                                                                                                                                                MD5:B5C8AF5BADCDEFD8812AF4F63364FE2B
                                                                                                                                                SHA1:750678935010A83E2D83769445F0D249E4568A8D
                                                                                                                                                SHA-256:7101B3DFF525EA47B7A40DD96544C944AE400447DF7A6ACD07363B6D7968B889
                                                                                                                                                SHA-512:A2A8D08D658F5ED368F9FB556BFB13B897F31E9540BFDFFF6567826614D6C5F0D64BD08FEC66C63E74D852AB6B083294E187507E83F2BC284DFB7CA5C86AE047
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d......:.........." .........(...............................................P......uM....`A........................................P.... ...........@...............,...!..............p............................................................................rdata..D".......$..................@..@.rsrc........@.......(..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-crt-process-l1-1-0.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):12752
                                                                                                                                                Entropy (8bit):6.604643094751227
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:192:uFdyqjd7NWthWxWf9BvVVWQ4mW+JZD7DiqnajKswzR1:YQsWthWkNfZGlGswzR1
                                                                                                                                                MD5:074B81A625FB68159431BB556D28FAB5
                                                                                                                                                SHA1:20F8EAD66D548CFA861BC366BB1250CED165BE24
                                                                                                                                                SHA-256:3AF38920E767BD9EBC08F88EAF2D08C748A267C7EC60EAB41C49B3F282A4CF65
                                                                                                                                                SHA-512:36388C3EFFA0D94CF626DECAA1DA427801CC5607A2106ABDADF92252C6F6FD2CE5BF0802F5D0A4245A1FFDB4481464C99D60510CF95E83EBAF17BD3D6ACBC3DC
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....u..........." .........................................................0............`A........................................P...x............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-crt-runtime-l1-1-0.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):16336
                                                                                                                                                Entropy (8bit):6.449023660091811
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:192:eUW9MPrpJhhf4AN5/KihWthWBWf9BvVVWQ4mWRXwsD7DiqnajKswzK:eUZr7HWthWUNkGlGswzK
                                                                                                                                                MD5:F1A23C251FCBB7041496352EC9BCFFBE
                                                                                                                                                SHA1:BE4A00642EC82465BC7B3D0CC07D4E8DF72094E8
                                                                                                                                                SHA-256:D899C2F061952B3B97AB9CDBCA2450290B0F005909DDD243ED0F4C511D32C198
                                                                                                                                                SHA-512:31F8C5CD3B6E153073E2E2EDF0CA8072D0F787784F1611A57219349C1D57D6798A3ADBD6942B0F16CEF781634DD8691A5EC0B506DF21B24CB70AEE5523A03FD9
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....h.y.........." .........................................................@............`A........................................P...4............0...................!..............p............................................................................rdata..............................@..@.rsrc........0......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-crt-stdio-l1-1-0.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):17872
                                                                                                                                                Entropy (8bit):6.3934828478655685
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:192:hA2uWYFxEpahDWthWDWf9BvVVWQ4mWR3ir+YVqnajKsSO:hIFVhDWthWONlfVlGsSO
                                                                                                                                                MD5:55B2EB7F17F82B2096E94BCA9D2DB901
                                                                                                                                                SHA1:44D85F1B1134EE7A609165E9C142188C0F0B17E0
                                                                                                                                                SHA-256:F9D3F380023A4C45E74170FE69B32BCA506EE1E1FBE670D965D5B50C616DA0CB
                                                                                                                                                SHA-512:0CF0770F5965A83F546253DECFA967D8F85C340B5F6EA220D3CAA14245F3CDB37C53BF8D3DA6C35297B22A3FA88E7621202634F6B3649D7D9C166A221D3456A5
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d......w.........." ......... ...............................................@......>>....`A........................................P...a............0...............$...!..............p............................................................................rdata..............................@..@.rsrc........0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-crt-string-l1-1-0.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):18384
                                                                                                                                                Entropy (8bit):6.279474608881223
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:384:jvEvevdv8vPozmVx0C5yguNvZ5VQgx3SbwA7yMVIkFGlPWthWXNjqujGlGswz7:2ozmT5yguNvZ5VQgx3SbwA71IkFFaJft
                                                                                                                                                MD5:9B79965F06FD756A5EFDE11E8D373108
                                                                                                                                                SHA1:3B9DE8BF6B912F19F7742AD34A875CBE2B5FFA50
                                                                                                                                                SHA-256:1A916C0DB285DEB02C0B9DF4D08DAD5EA95700A6A812EA067BD637A91101A9F6
                                                                                                                                                SHA-512:7D4155C00D65C3554E90575178A80D20DC7C80D543C4B5C4C3F508F0811482515638FE513E291B82F958B4D7A63C9876BE4E368557B07FF062961197ED4286FB
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...$............" ........."...............................................@............`A........................................P................0...............&...!..............p............................................................................rdata../...........................@..@.rsrc........0......."..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-crt-time-l1-1-0.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):14288
                                                                                                                                                Entropy (8bit):6.547753630184197
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:192:ENDCWthWHWf9BvVVWQ4mWG5xqcVT/gqnajKsrC/V:TWthW6N/xqc1IlGsrC/V
                                                                                                                                                MD5:1D48A3189A55B632798F0E859628B0FB
                                                                                                                                                SHA1:61569A8E4F37ADC353986D83EFC90DC043CDC673
                                                                                                                                                SHA-256:B56BC94E8539603DD2F0FEA2F25EFD17966315067442507DB4BFFAFCBC2955B0
                                                                                                                                                SHA-512:47F329102B703BFBB1EBAEB5203D1C8404A0C912019193C93D150A95BB0C5BA8DC101AC56D3283285F9F91239FC64A66A5357AFE428A919B0BE7194BADA1F64F
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d...E............" .........................................................0......f.....`A........................................P................ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\api-ms-win-crt-utility-l1-1-0.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):12240
                                                                                                                                                Entropy (8bit):6.686357863452704
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:192:ZjfHQdufWthWCWf9BvVVWQ4mWMlUteSP+CjAWqnajKsN0c:ZfZWthW/Nd4P+CcWlGsN0c
                                                                                                                                                MD5:DBC27D384679916BA76316FB5E972EA6
                                                                                                                                                SHA1:FB9F021F2220C852F6FF4EA94E8577368F0616A4
                                                                                                                                                SHA-256:DD14133ADF5C534539298422F6C4B52739F80ACA8C5A85CA8C966DEA9964CEB1
                                                                                                                                                SHA-512:CC0D8C56749CCB9D007B6D3F5C4A8F1D4E368BB81446EBCD7CC7B40399BBD56D0ACABA588CA172ECB7472A8CBDDBD4C366FFA38094A832F6D7E343B813BA565E
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............be..be..be...e..be...a..be......be...g..be.Rich.be.................PE..d....@n#.........." .........................................................0............`A........................................P...^............ ...................!..............p............................................................................rdata..............................@..@.rsrc........ ......................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\base_library.zip

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):1032264
                                                                                                                                                Entropy (8bit):5.502997687157409
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:24576:fhidCutosQNRs54PK4IMpVw597fCEb3avESWGR326V:fhidCutosQNRs54PK4Ir9avjWMHV
                                                                                                                                                MD5:8A2AF800E6C75ABE6D2FA4060655DD50
                                                                                                                                                SHA1:68B5B5B2F9BC3A951B47841957C03923C47D5C12
                                                                                                                                                SHA-256:E5D9CE91DAF8D8330E34D1E3856BD2B481EF55F374EB3836A429125E1F8E51C0
                                                                                                                                                SHA-512:913F829A36370F949BA055303E270A414646CE7D269B7E0FD6EB91D82B9CA5E337CE6714404386A48BB22C84034B9F92823DFA6CF104662D56FDFA27B28CD27A
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:PK..........!...7............._bootlocale.pycU....................................@....z...d.Z.d.d.l.Z.d.d.l.Z.e.j...d...r,d.d.d...Z.nJz.e.j...W.n4..e.k.rj......e.e.d...r\d.d.d...Z.n.d.d.d...Z.Y.n.X.d.d.d...Z.d.S.)...A minimal subset of the locale module used at interpreter startup.(imported by the _io module), in order to reduce startup time...Don't import directly from third-party code; use the `locale` module instead!......N..winTc....................C........t.j.j.r.d.S.t.....d...S.).N..UTF-8.........sys..flags..utf8_mode.._locale.._getdefaultlocale....do_setlocale..r......_bootlocale.py..getpreferredencoding...............r......getandroidapilevelc....................C........d.S.).Nr....r....r....r....r....r....r...............c....................C........t.j.j.r.d.S.d.d.l.}.|...|...S.).Nr....r......r....r....r......localer......r....r....r....r....r....r.....................c....................C....6...|.r.t...t.j.j.r.d.S.t...t.j...}.|.s2t.j.d.k.r2d.}.|.S.).Nr......darwin....A

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\certifi\cacert.pem

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:ASCII text
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):281617
                                                                                                                                                Entropy (8bit):6.048201407322743
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:6144:QW1H/M8fRR1mNplkXURrVADwYCuCigT/Q5MSRqNb7d8iu5f:QWN/TR8NLWURrI55MWavdF0f
                                                                                                                                                MD5:78D9DD608305A97773574D1C0FB10B61
                                                                                                                                                SHA1:9E177F31A3622AD71C3D403422C9A980E563FE32
                                                                                                                                                SHA-256:794D039FFDF277C047E26F2C7D58F81A5865D8A0EB7024A0FAC1164FEA4D27CF
                                                                                                                                                SHA-512:0C2D08747712ED227B4992F6F8F3CC21168627A79E81C6E860EE2B5F711AF7F4387D3B71B390AA70A13661FC82806CC77AF8AB1E8A8DF82AD15E29E05FA911BF
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\charset_normalizer\md.cp38-win_amd64.pyd

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):9728
                                                                                                                                                Entropy (8bit):6.599679776617318
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:96:Id0Mp/QthczuG47NfGTJiWpjy9h+laGgazukYBbPJBj34lVhXg246ae7sXtpHqrY:It6tq4hfGNp2azdzukYj273QJXpHIH
                                                                                                                                                MD5:3EC61DACFBE1E165DE5FE35FB92FA6D4
                                                                                                                                                SHA1:A7605431D0A9BABE59CDBD5D39C292D5AB8BBF43
                                                                                                                                                SHA-256:3ACEA3CB557E4A7DF92FC34AD2CB1D654CF3C2254C00C690DA32C1A1F27BA4FA
                                                                                                                                                SHA-512:8E1DD08528C3A04086C914094D3A21A78962249A65EE31A7A2AAE37D59A004E1586D16254DA8FACCBB9386025BE538041C968A1DC4AD90FD35921A12910DECFE
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B1...P...P...P...(...P.../...P..M(...P.../...P.../...P.../...P...$...P...P.. P..?...P..?...P..?.a..P..?...P..Rich.P..........................PE..d....gAe.........." ...%. .......p........................................................`.........................................@...l......P............@..........................................................@...........................................UPX0.....p..............................UPX1..... ..........................@....rsrc................"..............@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\charset_normalizer\md__mypyc.cp38-win_amd64.pyd

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):39424
                                                                                                                                                Entropy (8bit):7.8391240913672435
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:768:4ULF2V3+5GZkuG1xI0EcbOkA6BgKjxbcg3opQAsiMOvpBel:Tc3wGrc4FqgrLOAsiBel
                                                                                                                                                MD5:599D207F2DEBB191A262B407C4CC72F4
                                                                                                                                                SHA1:3BD74DA03C4FE18566E5AEF38B871FAC759FB2D8
                                                                                                                                                SHA-256:004CF0FE91F3A5837CD7BABFE21F5C8461E7A181B7C94AEF92EEE7CF7B327FC8
                                                                                                                                                SHA-512:6DB4B491E8AC9EBFF482A38FE2AB26592B1610D3A53DF9F630F604FE2EE8B8B7F8020D2BE9F37870F7E942A857B84E90FD7A3DB92E2F1119273DCC35CA21B9C6
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............pr..pr..pr......pr...s..pr...s..pr...w..pr...v..pr...q..pr.#.s..pr..ps..pr...z..pr...r..pr......pr...p..pr.Rich.pr.........................PE..d....gAe.........." ...%.............3.......................................`............`..........................................R..`....P.......P......................8S.......................................?..@...........................................UPX0....................................UPX1................................@....rsrc........P......................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\exe\netconn_properties.exe

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32 executable (console) Intel 80386, for MS Windows, UPX compressed
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):61440
                                                                                                                                                Entropy (8bit):7.921620889726641
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:1536:HQDJbWAHTCQezq6UT9fLUwTEJ6hh9BUusFvQrnouy8:cJiES2RfYEhyusFvaout
                                                                                                                                                MD5:3B8E84142573A5E30990BDE2E574C447
                                                                                                                                                SHA1:C3EB3D19655F022B404E6F35764BBF80931FACB6
                                                                                                                                                SHA-256:844BC565498F3C7B74E46770EDC35EB3A20F16F0EB619250C83E40ECA1C0F493
                                                                                                                                                SHA-512:3AD2BE91CEDCC261227A496C51A39F69933B6396735E15E51458D48BD69F444201BA948A5E639345222B18981833F47F19538375DBE2C4C37014377B2031DA2D
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......... 7..Nd..Nd..Nd..Me..Nd..Ke..Nd..Je..Nd..Me..Nd..Ke..Nd..Je..Nd..Oe..Nd..Od..Nd+.Ge..Nd+.d..Nd+.Le..NdRich..Nd........PE..L......d...............".........p...Z.......p....@.......................................@..................................q.......p.......................r.. ...................................|f..............................................UPX0.....p..............................UPX1................................@....rsrc........p......................@......................................................................................................................................................................................................................................................................................................................................................................................4.02.UPX!....

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\exe\registers.exe

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32 executable (console) Intel 80386, for MS Windows, UPX compressed
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):11264
                                                                                                                                                Entropy (8bit):6.941070129699565
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:192:29c0mnxpjAz4YtdRinGDoPNm0aFFaNJhLkwcud2DH9VwGfct0nDs:cmnx+MYUnmoPHaTaNJawcudoD7Uws
                                                                                                                                                MD5:527010682A02EE5935BAC5B2D074C49D
                                                                                                                                                SHA1:868586F9C46F0BE6F33E732BFB25885608DD760F
                                                                                                                                                SHA-256:6F5CF5FB3EC821E23D3B7039B45084FB746335E87609523E97559AA464CECFAA
                                                                                                                                                SHA-512:F78983EC4168478730573C108A1F6463B0479A3C07091E66A07E84FD5641788434D6FCA8D9C659692337095FE55E3DFCF748F8712334832AA8B602EB68AFCB8C
                                                                                                                                                Malicious:true
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........@.P...P...P...Y..\.....+.H.....*.\.....-.Q...../.U..../.R...P./.....F.'.Q...F...Q...F.,.Q...RichP...........................PE..L...6..e...............$.0.......p................@.......................................@.................................................................... ...................................|...............................................UPX0.....p..............................UPX1.....0......."..................@....rsrc................&..............@..............................................................................................................................................................................................................................................................................................................................................................................4.02.UPX!....

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\exe\upx.exe

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):537600
                                                                                                                                                Entropy (8bit):7.929208677101443
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:12288:fOHsWPQsJdQmiR0eYG16fyP8RHzS75CaNgMYqIW7I2:2QmiWK16rRHzS7U6ip2
                                                                                                                                                MD5:8A98406E32ED6139BD9E75342D452948
                                                                                                                                                SHA1:ED77737B88A7351D0BC5F542DDB7CE84F8F95588
                                                                                                                                                SHA-256:A4240EA0E8A916D15F8391EDEF9705AB4DE1F516DD360F0A336C5358686D434B
                                                                                                                                                SHA-512:F5B17975560D97308A6EE66845225715E82BADE9DF7BC36821C76FE67FCF8D22929BF21B85E28DD11B7399D0109AB1F3786FD2010C2E5023D3A93D2BD5CF678B
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................./......0..........@. .......@..............................0 ............... ..............................................% ...... ......P................................................ .(...................................................UPX0....................................UPX1.....0.......*..................@....rsrc........ ......,..............@...4.02.UPX!.$...............%...h..I.....m....D..f.....H..(H..58..1.......$.6.9..K..7.5f.8MZu.Hc...P<H..PE4tiR..._.........uF.i....d...B..6.y.7......`....o.,..1.8.tS1.L.(...~t@........P....wm..JE..u.........~...c...........#ha.............|..3.xtuD...wEzy7...f.^84%6L..w....^.......^....;..48..D$ R.....A.qt..8..AUATU....WVSH........lL...H..*..x=x6...........le&.%0...4..p.1.L.....%......H9...X......_.......H..3H..p5.g.};h.....Q#.2.........]..=8...Y,.Un...3..t.EX....?M..n.......

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\libcrypto-1_1.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):1173184
                                                                                                                                                Entropy (8bit):7.943479776599919
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:24576:R+bGt1aXDUPxepW5HoZS4F4Z7KMUZVZ2OADo2ksJY1CPwDv3uFfJ:4KnYwwpsTOLnNt2kWY1CPwDv3uFfJ
                                                                                                                                                MD5:EB33B1A0A12A1BFCB69FD2467F5C6B8C
                                                                                                                                                SHA1:D30782A6BED3FD889846787D733D14519D757808
                                                                                                                                                SHA-256:E631BFE0B26A864F61311A03BF1F0819ABDFFC7BC00D14D263714F934A085069
                                                                                                                                                SHA-512:BEE2412914003AD4697D6A22CFE7550DE0E13C2A16DC5C8C1528CE361A84F987E8D43F58F0EABDACF6A09A01F7EDF04B310DCE41F02C4E809B04446D8DFF40E2
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x...<.<.<.5.;...n...>.n...7.n...4.n...?.g...7.<.......!.....E.....=...W.=.....=.Rich<.................PE..d....El`.........." ..............%...4.. %...................................6...........`......................................... .4.......4.h.....4.......1...............6.......................................4.............................................UPX0......%.............................UPX1......... %.....................@....rsrc.........4.....................@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\libffi-7.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):24088
                                                                                                                                                Entropy (8bit):7.527291720504194
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:384:hRZBxuj5W4IBzuU2CUvOEvba4Za7gJXkrZRCXEpnYPLxDG4y80uzFLhHj:rwlGuUm2Evb1p07pWDG4yKRF
                                                                                                                                                MD5:6F818913FAFE8E4DF7FEDC46131F201F
                                                                                                                                                SHA1:BBB7BA3EDBD4783F7F973D97B0B568CC69CADAC5
                                                                                                                                                SHA-256:3F94EE4F23F6C7702AB0CC12995A6457BF22183FA828C30CC12288ADF153AE56
                                                                                                                                                SHA-512:5473FE57DC40AF44EDB4F8A7EFD68C512784649D51B2045D570C7E49399990285B59CFA6BCD25EF1316E0A073EA2A89FE46BE3BFC33F05E3333037A1FD3A6639
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.3.r}]Ar}]Ar}]A{..Ap}]A .\@p}]A..\@q}]Ar}\AU}]A .X@~}]A .Y@z}]A .^@q}]A..Y@t}]A..^@s}]A..]@s}]A.._@s}]ARichr}]A........................PE..d......].........." .....@................................................................`.........................................................................................................................................................................UPX0....................................UPX1.....@.......:..................@...UPX2.................>..............@......................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\libssl-1_1.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):202432
                                                                                                                                                Entropy (8bit):7.916943155937212
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:6144:2KEAslm/r4HLTmpLdH29Vam7bJnm8yPR:2U6+mTmpcram7NNy
                                                                                                                                                MD5:88803AAC099CCCF4AF3496BFABDC8865
                                                                                                                                                SHA1:3EEE4E685E0084F13935870BE3E2C7DDDB1975E4
                                                                                                                                                SHA-256:C524B961D036C9E95AE4D9E40E8B4F897A4F0772CF1D78AC0287AF84FE918CAD
                                                                                                                                                SHA-512:50BD41771E50E9C20AD871BE9433F6E88C3CD799A6F64D7AD19265228468A8572904EC2D9B3B8FF053B23230EC1326A175DF09CB0380E60D8EFDD11AB446F8FD
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...BkT.BkT.BkT.:.T.BkT.*jU.BkT.*jU.BkT.*nU.BkT.*oU.BkT.*hU.BkT(+jU.BkT.BjThCkT(+oU.BkT(+kU.BkT(+.T.BkT(+iU.BkTRich.BkT........................PE..d....El`.........." .........P...P..P....`...................................`............`.............................................4@.......................K...........V......................................P...............................................UPX0.....P..............................UPX1.........`......................@....rsrc....P.......H..................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\psutil\_psutil_windows.pyd

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):34816
                                                                                                                                                Entropy (8bit):7.756084875002629
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:768:nrA/j6Vq1p3Kuu42ShVZmBKDRAdlq9gYe7JSp+AG:Wjz1p3dVZmBJQgpNA
                                                                                                                                                MD5:FA4A63CC5BBC7B119DDEB9469B17A55D
                                                                                                                                                SHA1:72EF6F8E5E7FE13EA64973E05DB297C8455754FB
                                                                                                                                                SHA-256:EE2EACA1473E460BEFEBBC0149BA1A4537A9C9303C10AAA2FF6D8C8F74AC8BA3
                                                                                                                                                SHA-512:77D0E34A46D0C05C9DE527283F726E6A7C96FE473D0C6A6F707EEA14F3BE4D1383BBD03B552C27455175ECC66CFF242177829154CA6EA4A12D704DE285693F41
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.][~.3.~.3.~.3.w...t.3.,.2.|.3.,.6.r.3.,.7.v.3.,.0.z.3...2.|.3.5.2.o.3.~.2...3...;.r.3...3...3.......3...1...3.Rich~.3.........PE..d.....ic.........." ............. .......0................................................`.........................................8...`......H............P..4......................................................8...........................................UPX0..... ..............................UPX1.........0...~..................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\pyexpat.pyd

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):83120
                                                                                                                                                Entropy (8bit):7.907238064399988
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:1536:Xp6V6J1lSnf2bGaeYiO3YM6gl7Sm24a1WUxCosj8dVu4pFUr9j2nNYsvkBExg9IE:oVY1InOb3ezY7Sm1a11xC/8SsMIIBh91
                                                                                                                                                MD5:5F5C5041C392FA352223F248F056639F
                                                                                                                                                SHA1:5FB30449F84653B3B26B1E2820577A67FD52AFB0
                                                                                                                                                SHA-256:044751B6EB51B5D2E75394F7DA265747063101F2310E1D0AB6AB79DF7F589BE3
                                                                                                                                                SHA-512:DE0F31D3B11DC45AB62EE0696B2031814A3D7F7DBAED98A27E87191850038A3930769B49826CB1D8E44D4F29A632EAB65277BB52156C917B599CC06E9F0B1718
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[.;f..U5..U5..U5...5..U5s.T4..U5s.P4..U5s.Q4..U5s.V4..U5..T4..U5D.T4..U5..T5o.U5..X4..U5..U4..U5..5..U5..W4..U5Rich..U5........PE..d...u.`.........." ..... ..........p(... ...................................P............`.........................................tL..P....I.......@.......................L......................................p4..8...........................................UPX0....................................UPX1..... ... ......................@....rsrc........@......................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\python3.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):59568
                                                                                                                                                Entropy (8bit):5.881803359169673
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:768:bS99q+0o22ByfbEap+VCBQ53gUiT5pLFdBk4/yFi1nuVwWBjChtFyrUdmd9RSxD0:M9xiEAnUvdy5IIB0/ya7
                                                                                                                                                MD5:C9F0B55FCE50C904DFF9276014CEF6D8
                                                                                                                                                SHA1:9F9AE27DF619B695827A5AF29414B592FC584E43
                                                                                                                                                SHA-256:074B06AE1D0A0B5C26F0CE097C91E2F24A5D38B279849115495FC40C6C10117E
                                                                                                                                                SHA-512:8DD188003D8419A25DE7FBB37B29A4BC57A6FD93F2D79B5327AD2897D4AE626D7427F4E6AC84463C158BCB18B6C1E02E83ED49F347389252477BBEEB864AC799
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............d...d...d.0.l...d.0.d...d.0.....d.0.f...d.Rich..d.................PE..d...j.`.........." ......................................................................`.........................................` ..@............................................ ..T............................................................................text............................... ..`.rdata..d.... ......................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\python38.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):1436848
                                                                                                                                                Entropy (8bit):7.991911842353948
                                                                                                                                                Encrypted:true
                                                                                                                                                SSDEEP:24576:4x/FMCGq6fqOD+5QKiQ6SqHPz5nTD8DRr7iNh+PyteisMfU5cSNdFHpFetZv710+:sSCYfqVmK56SK9TD80ptebRNXHpFeg+
                                                                                                                                                MD5:7AB78070CA047F134156169C60CCA0A3
                                                                                                                                                SHA1:F3FE769A202936D4C533A643F9A8B7CBDDA61CA4
                                                                                                                                                SHA-256:C57BD27215609ECA66BEA7F88F4B5CE3BF39486DFDBAB7D5C684270507627D22
                                                                                                                                                SHA-512:2F3CD43BEB3E0E1EA1581337289566159A707F3314852DC88C0353A65DD4A6D549AAC1EA66974893EC99A3C1E28B932D7D3AB9E612D102CB6211772F594181F1
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........`....................................................................j...q...j.......j.....j.......Rich............................PE..d...a.`.........." .............`...\C..p...................................PD...........`.........................................8.C......yC.L....pC......p@..............AD......................................hC.8...........................................UPX0.....`..............................UPX1.........p......................@....rsrc........pC.....................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\pywin32_system32\pythoncom38.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):200192
                                                                                                                                                Entropy (8bit):7.903772238406268
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:3072:s7yyhL4NvlJyiWXG3OfJHe3ACEVXTCTWoKQnJhHkKwONMGsnG2bQUHJPpdir:sRhL4rsiWsWBibwevEKwO2GEGAtpd
                                                                                                                                                MD5:E66C96A48F85B9F0B44D5006AEA7DAAC
                                                                                                                                                SHA1:2E5ADB142EA5BB79DCDA2B72671B76855B85F633
                                                                                                                                                SHA-256:EAEA8C3093EA2F566F7EF3F95CEF86E58FB9889E6D0423D6F0E182C86D6472FC
                                                                                                                                                SHA-512:6659451D4495A8697A36205F80CF5174070BE354796B4618ED3C615D3335E4E4A5D47CFD1C4F8D3516A36FEAF8E81D5CB6F53006F2A3BEB2977D105C71975763
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........x...+...+...+.P+...+...*...+...*...+...*...+...*...+...*...+..*...+..*...+..*...+...+...+...*...+...*...+...*...+Rich...+................PE..d...a..d.........." .........p... .......0...................................@............`......................................... ....c..`...........`........z...........:..........................................8...........................................UPX0..... ..............................UPX1.........0......................@....rsrc....p.......l..................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\pywin32_system32\pywintypes38.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):64000
                                                                                                                                                Entropy (8bit):7.595690275773314
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:1536:48yGA8d6epdvLhWVhLAS1FjL9NxFRgCbTp4SZt8ei:9x7hYLAgFjLnxFV/p4le
                                                                                                                                                MD5:C9B84B1AC14813C7C8FC5E7AB6EF788B
                                                                                                                                                SHA1:C5EED330F129E5C6A9B817AD081CF8722E9EB147
                                                                                                                                                SHA-256:F1D4431DA1300B9FE40DBE6C1E2C8311CD7F458EA1D8F2DB234137CF57C5D2D2
                                                                                                                                                SHA-512:BD4B3AF8C9B87110197EA64572E97EA027EAD198EB24DE8EEE43BB70913E53BF96368FF2C1BF4D2BB5DB3EAB24DDB9F043760CF5A64EF6BBAF09DC63000ECA26
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+.$.J.w.J.w.J.w.2Kw.J.w.?.v.J.w.%%w.J.w.?.v.J.w.?.v.J.w.?.v.J.w.!.v.J.w.,.v.J.w.!.v.J.w.J.wNJ.wh?.v.J.wh?.v.J.wh?.v.J.wRich.J.w................PE..d......d.........." .........P...........................................................`.........................................h...`B..h...........h....0.........................................................8...........................................UPX0....................................UPX1................................@....rsrc....P.......J..................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\select.pyd

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):22192
                                                                                                                                                Entropy (8bit):7.347287608561872
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:384:Q9Pj6VLmXzJIGHkjCc4PevAZa7gJXdMrIImGbJ7EDG4y8iD0hS:1VSXzSIpNMrIImGbJYDG4y+hS
                                                                                                                                                MD5:BFCE179B385145F6C0CB73AAC30318C1
                                                                                                                                                SHA1:FF59AB14CBEB00A9C68369D998B101102673B6E2
                                                                                                                                                SHA-256:04F0936EC038FF18927B5DEF896DB658B64F6DC9E6275E6AD03A7436D4F9A80A
                                                                                                                                                SHA-512:A82ED3398C4F1C0D0AB8A5F5E75735D6D05D6F02C9B0A97EDB478482A0F3BEE0F49FEA35C5AFDFE373C33ADE510D0EBFF8DD02B0131D961BE7E5B5DDCBFDB88F
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........*.J.D.J.D.J.D.C...H.D.&.E.H.D.&.A.A.D.&.@.B.D.&.G.N.D...E.H.D...E.O.D.J.E.t.D...I.K.D...D.K.D....K.D...F.K.D.RichJ.D.........PE..d...o.`.........." .....0.......... .....................................................`.........................................d...L.......|............`......................................................0...8...........................................UPX0....................................UPX1.....0.......*..................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\ucrtbase.dll

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):1035728
                                                                                                                                                Entropy (8bit):6.630126944065657
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:24576:EsKxVJ/pRRK0Y/9fCrl4NbpjONcncXEomxvSZX0yp49C:lKxDPHQCrlQBXxw
                                                                                                                                                MD5:849959A003FA63C5A42AE87929FCD18B
                                                                                                                                                SHA1:D1B80B3265E31A2B5D8D7DA6183146BBD5FB791B
                                                                                                                                                SHA-256:6238CBFE9F57C142B75E153C399C478D492252FDA8CB40EE539C2DCB0F2EB232
                                                                                                                                                SHA-512:64958DABDB94D21B59254C2F074DB5D51E914DDBC8437452115DFF369B0C134E50462C3FDBBC14B6FA809A6EE19AB2FB83D654061601CC175CDDCB7D74778E09
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........of...5...5...5..5...5...5&..5...5...5...4...5...4...5...4...5...4...5...4..5...5...5...4...5Rich...5........PE..d.....$%.........." .....:..........0Z..............................................7^....`A................................................................. ...........!.............p........................... f..............................................text...09.......:.................. ..`.rdata..^....P.......>..............@..@.data....&..........................@....pdata....... ......................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\unicodedata.pyd

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):287408
                                                                                                                                                Entropy (8bit):7.985748275421679
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:6144:GftoxCDFCv7FooOAr+MLDhGX2TUY2E/xFb30whI1o/yOp8wH2UN8u6ih6:CDDovNrRGGTvF5FZhI1o/yS88Ndh6
                                                                                                                                                MD5:F9486E61971743562E9CDFAC3B26B9B8
                                                                                                                                                SHA1:827CC385D614535A17C37A899017E95ABEE90384
                                                                                                                                                SHA-256:D35630AC31C32CEB5098EB2E63B029EBEE37167C6DA320F07574A244A8336554
                                                                                                                                                SHA-512:5BAC1699C2B11FBA9A25112672DC30F2DD7A1058161066939667F467470CDDACF6E8DDBB0AFAAB0395BCBFFE67743231640CD70ACB9DCAD2645743F5F0DBCFF5
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.T~~.:-~.:-~.:-w..-x.:-..;,|.:-..?,r.:-..>,v.:-..9,}.:-..;,}.:-%.;,|.:-~.;-4.:-..7,..:-..:,..:-...-..:-..8,..:-Rich~.:-........................PE..d...q.`.........." .....@................................................... ............`.............................................X.......................H...........D...........................................8...........................................UPX0....................................UPX1.....@.......4..................@....rsrc................8..............@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\win32\_win32sysloader.pyd

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):11776
                                                                                                                                                Entropy (8bit):6.768385706088112
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:192:BhVG7AsfBUmejljLpciF5JEw/80/cwDIvkYj273QJXhEDE/wx8p:omjhZF5JEw005IvZa7gJXOE/wx
                                                                                                                                                MD5:75BE08C4B0982D2BEE8BFDC3571B90BC
                                                                                                                                                SHA1:F131B660569166243CECC1EAEE7EF2427D968D4E
                                                                                                                                                SHA-256:871079FF742DD22E944820510D723BF140E69397814BA9F1C1CEE13421CBEB09
                                                                                                                                                SHA-512:888CDA61F383C57F6781441B781F2EA4596D4BF24FF9E11DB8DC59D7A244ECAEE7E06BA86A67E32A13E2A5A78C597D013474AFCDA178D38E832E364830603E01
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........tf...........m......`.....~......`......`......`.....s...........k`.....k`.....k`.....Rich....................PE..d......d.........." .....0..........0.....................................................`.............................................`...p...P.......p....`.............. .......................................0...8...........................................UPX0....................................UPX1.....0.......$..................@....rsrc................(..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\win32\win32api.pyd

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):50176
                                                                                                                                                Entropy (8bit):7.856075315952315
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:1536:rCqUvYAXWuxLjyimF6As/Z3bGUuvsCVXCaue:rCqwtr/yimoxB3dukte
                                                                                                                                                MD5:A5164377C56078FA97E42C4CCD7E3C17
                                                                                                                                                SHA1:5D4E05710848E757D52DAA0C2A9DD806FA22D35A
                                                                                                                                                SHA-256:B00E9D8604CF0E3436E5F44AF51C352762089D5EED53F84FB109E1EDDF7F1A84
                                                                                                                                                SHA-512:63E3D98CA3E1DCE64D0D5F49695CD7B3740154D6D9F6E23A2E84687E54D414C41BCAB07626EA685A350E55A3414EF10FC429910CE06B9AF240B2796C536A6202
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\.uV.z...z...z.......z..J....z..J....z..J....z.......z.......z..J....z.......z...z..O{.......z.......z.......z..Rich.z..........................PE..d......d.........." ................0.....................................................`.................................................X...........X.... ......................................................0...8.......................@...................UPX0....................................UPX1................................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\win32\win32net.pyd

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):34304
                                                                                                                                                Entropy (8bit):7.6971745920156325
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:768:Zzr7HjHd8/GHaJ31sd2rhSky7aY0jDN8CK/yPebpLNf:ZzPHbd8JFsd2rJXYcRKMeZNf
                                                                                                                                                MD5:DD20D1245098A40C8729A931B5402718
                                                                                                                                                SHA1:228E9EA731D3A2EE8C227C78523F9285314FC6E0
                                                                                                                                                SHA-256:9228F21326C91E1FBD620328D8C33B52DB7743943C8890F1EC65287206DEACD2
                                                                                                                                                SHA-512:2259793ED01162428FE68C0BB8A2A87577F4129478A179D1151D8332A7190E60B18ACBEF5C40B10CD901DEB01528D3D7E658B0E81D21BF6C4E67A2E214E68594
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:.U.T.U.T.U.T.\..Q.T...U.Q.T...Q.D.T...P.].T...W.V.T...U.W.T.A.U.W.T.A.U.R.T.U.U..T...].R.T...T.T.T...V.T.T.RichU.T.........PE..d......d.........." ......................................................... ............`.............................................P...X...........X...................X...........................................8...........................................UPX0....................................UPX1.............z..................@....rsrc................~..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\win32\win32security.pyd

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):51200
                                                                                                                                                Entropy (8bit):7.823054231458668
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:1536:kvdj32qzofwYTVzIiX8ARibgxe8+ShUV:sdCcoRFXA6rvUV
                                                                                                                                                MD5:502D5987825F4F6D4627D6C80088743A
                                                                                                                                                SHA1:77FFEDE001A1207D549A3B55625478A866D7E5AC
                                                                                                                                                SHA-256:5B3C7EE3E22B1839C1C6C515C03FB31E6E792DB99E825135B281A64A5AB7C252
                                                                                                                                                SHA-512:1494D316C7B89ED0DFA620F6914F765CF4BFFCF5B508045D5B1D29719F655947424887A21172F164CA0D5CC018703DE3C5D20FB52AFF2F0B3D6089475F600BC7
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........L)i^-G:^-G:^-G:WU.:V-G:.XF;Z-G:.XB;O-G:.XC;V-G:.XD;]-G:.XF;\-G:JKF;\-G:JFF;W-G:^-F:.-G:.XN;]-G:.XG;_-G:.XE;_-G:Rich^-G:........................PE..d......d.........." ..................... ................................................`.................................................h...........h....`..........................................................8...........................................UPX0....................................UPX1......... ......................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\win32\win32trace.pyd

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):14848
                                                                                                                                                Entropy (8bit):7.096312139520411
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:384:9mIxvg14DDBoqz0VMUW6u7D5rm4Za7gJXH51BJN:HV+4poPV/W/n59p3bB7
                                                                                                                                                MD5:3B821D786242A4BA72F8EAD9FA6DB6DA
                                                                                                                                                SHA1:EE5BD3D7919564A1DBD6751DF833089105A5E3C1
                                                                                                                                                SHA-256:B890A6781AB64F4EF12F507DCCFD617445362645FCC20963679D627DB97298DD
                                                                                                                                                SHA-512:F936C88701EDAF14578F8AB1B5AD530FFD83FB0DD60320D19734EAC48E71C49459D93F66AFF59B78734545C3F2CB9370412D1E0165DC439E22B3B652D84A63D9
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........*U.bD..bD..bD......bD...E..bD...A..bD...@..bD...G..bD.?.E..bD...E..bD...E..bD..bE..bD.?.M..bD.?.D..bD.?.F..bD.Rich.bD.........PE..d......d.........." .....0................................................................`.............................................T...`...8.......`....p..........................................................8...........................................UPX0....................................UPX1.....0..........................@....rsrc................2..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\win32\win32wnet.pyd

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):20480
                                                                                                                                                Entropy (8bit):7.406348326088368
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:384:+CQ3drserOIUVmRhRgx61UJJ0kKszKHIwZa7gJXLB26tO:+hTU+gx6k4DpbB26tO
                                                                                                                                                MD5:014AF0E1EAA9A31EAE687F1EAE823810
                                                                                                                                                SHA1:22BCD2192469992935E00CEB2B0B9A8B90A28C9C
                                                                                                                                                SHA-256:CACEEE05760DAEFE177B1ABC915A1ABAB512A7F8B0689DDC600F57301A019C6B
                                                                                                                                                SHA-512:2A7D05D89A395D8A948AA31494D9620DB165CD67A5720519597C000615FB7F7215C62A8E2EFFA1BA6AECFF0E683633BFF33819797263DE007DA233AE725D7882
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........fTG..:...:...:.......:..r;...:..r?...:..r>...:..r9...:.Tr;...:..a;...:..l;...:...;...:.Tr3...:.Tr:...:.Tr8...:.Rich..:.........PE..d......d.........." .....@................................................... ............`.........................................H...H...X...........X...............................................................8...........................................UPX0....................................UPX1.....@.......@..................@....rsrc................D..............@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\zstandard\_cffi.cp38-win_amd64.pyd

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):264192
                                                                                                                                                Entropy (8bit):7.9936286609130285
                                                                                                                                                Encrypted:true
                                                                                                                                                SSDEEP:6144:3PvqH4ND5vg9tYqXFDy+F1g9xcirKkClmRaGvw0:3PHNDEVGEWxbrKLgYGI0
                                                                                                                                                MD5:BB5E0471A4CE96408EA8D3B667AABFC9
                                                                                                                                                SHA1:072E7CDFC513580E6291B368546F42E9764F7C85
                                                                                                                                                SHA-256:828EE83BE8E6088D3452770301E9888DFA2D48C01BD5ED06922955481F0A1FC3
                                                                                                                                                SHA-512:810771F87692124100C2E5275F18505E28DE0A4AF546954F8C8DA1971AFBD2D9BB817B928257B7A3CFC3D30DFAAC20D002CCF8B2F4FE3362E44B74BC2B2DA954
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n...*...*...*...#.8. ...e..(...a..(...e..'...e.."...e.........)...*...b......(......+.....T.+......+...Rich*...........PE..d.....<d.........." ...".........@...B...P...................................`............`.........................................lS..X....P..|....P..........$H...........S.......................................N..@...........................................UPX0.....@..............................UPX1.........P......................@....rsrc........P......................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                C:\Users\user\AppData\Local\Temp\_MEI12682\zstandard\backend_c.cp38-win_amd64.pyd

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):233984
                                                                                                                                                Entropy (8bit):7.9891918400504665
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:6144:k61SUiamsDELcQvCVd5RYFwDs2dfDgBTgyX75vOIW43whQDL:k4SUrIFvCnYqZfcTVNvLlH
                                                                                                                                                MD5:7EEBDF85AFD93370AA72A607049C7564
                                                                                                                                                SHA1:A60FA68592F9D3AA06C220C865782FF3E92C025B
                                                                                                                                                SHA-256:41A3712D497420B701A938F6FDABC93589D083079A53AFF7EC0F55C8C3A07D32
                                                                                                                                                SHA-512:6EEB5AD15DDE41D1A67A3DCA4DEE0DC06CE5D382DC2F2CBAF2B6D04D4CD72785786E4AEF6F345032802B70F13C49282683AD92A064FECF3C0592DABA04F90E74
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........t............................................................E...............[.......[.......[.....[.......Rich............PE..d...x.<d.........." ..."............P+.......................................P............`......................................... C..`....@..0....@..........x<...........C......................................P7..@...........................................UPX0....................................UPX1................................@....rsrc........@......................@..............................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.$..

                                                                                                                                                C:\Users\user\AppData\Local\Temp\tmp179_cpv3\gen_py\__init__.py

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:ASCII text, with CRLF line terminators
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):176
                                                                                                                                                Entropy (8bit):4.713840781302666
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:3:S3yE25MOWrYXtHVE/DRFrgm5/gvJgXDLAUDA+ERo6+aEYqVS1f6gq1WGgVSBn:S3mSOWWHVUDjrgmxgRgzLXDA6Va8VeuR
                                                                                                                                                MD5:8C7CA775CF482C6027B4A2D3DB0F6A31
                                                                                                                                                SHA1:E3596A87DD6E81BA7CF43B0E8E80DA5BC823EA1A
                                                                                                                                                SHA-256:52C72CF96B12AE74D84F6C049775DA045FAE47C007DC834CA4DAC607B6F518EA
                                                                                                                                                SHA-512:19C7D229723249885B125121B3CC86E8C571360C1FB7F2AF92B251E6354A297B4C2B9A28E708F2394CA58C35B20987F8B65D9BD6543370F063BBD59DB4A186AC
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:# Generated file - this directory may be deleted to reset the COM cache.....import win32com..if __path__[:-1] != win32com.__gen_path__: __path__.append(win32com.__gen_path__)..

                                                                                                                                                C:\Users\user\AppData\Local\Temp\tmp179_cpv3\gen_py\dicts.dat

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:data
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):10
                                                                                                                                                Entropy (8bit):2.7219280948873625
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:3:qW6:qW6
                                                                                                                                                MD5:2C7344F3031A5107275CE84AED227411
                                                                                                                                                SHA1:68ACAD72A154CBE8B2D597655FF84FD31D57C43B
                                                                                                                                                SHA-256:83CDA9FECC9C008B22C0C8E58CBCBFA577A3EF8EE9B2F983ED4A8659596D5C11
                                                                                                                                                SHA-512:F58362C70A2017875D231831AE5868DF22D0017B00098A28AACB5753432E8C4267AA7CBF6C5680FEB2DC9B7ABADE5654C3651685167CC26AA208A9EB71528BB6
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:..K....}..

                                                                                                                                                \Device\ConDrv

                                                                                                                                                Download File
                                                                                                                                                Process:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                File Type:JSON data
                                                                                                                                                Category:dropped
                                                                                                                                                Size (bytes):71
                                                                                                                                                Entropy (8bit):4.432106231961828
                                                                                                                                                Encrypted:false
                                                                                                                                                SSDEEP:3:poJABFReNmI47BAuF5QEyn:3MmI4q3
                                                                                                                                                MD5:8E8C632FF4048AA416057B3C5336B6CE
                                                                                                                                                SHA1:381EDCA9BBCA3F705E476D18094A61CE265A2998
                                                                                                                                                SHA-256:8EAE147B5D82300DA0DF4DFB35F8635CA2E38BDFB8A40A21944F9C890EBE90A8
                                                                                                                                                SHA-512:A6B2365B97A468BA5E6A0A9265A9319357446A11F6E083C4674ABFDFBCA54794E33E1E92119C9758AD86BBFC23AD48AD1AC37C0FEC8B3A429EC02D48082277EA
                                                                                                                                                Malicious:false
                                                                                                                                                Preview:[3424] Failed to execute script 'grabber' due to unhandled exception!..

                                                                                                                                                Static File Info

                                                                                                                                                General

                                                                                                                                                File type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                Entropy (8bit):7.9956456855740825
                                                                                                                                                TrID:
                                                                                                                                                • Win64 Executable Console (202006/5) 92.65%
                                                                                                                                                • Win64 Executable (generic) (12005/4) 5.51%
                                                                                                                                                • Generic Win/DOS Executable (2004/3) 0.92%
                                                                                                                                                • DOS Executable Generic (2002/1) 0.92%
                                                                                                                                                • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                File name:xSO7sbN2j6.exe
                                                                                                                                                File size:11'440'768 bytes
                                                                                                                                                MD5:5917c8e5a003b2c211150d1f92440f79
                                                                                                                                                SHA1:fc3dfd511d75828c56aec3be55931d42bfbdd96e
                                                                                                                                                SHA256:95256b28dfb85f1d5bafdec109950775733d4af82acc0512151639695c57e469
                                                                                                                                                SHA512:ba686693de8c474d819ca65e6d44ae0d32aae82f71faa40052c1ace81ca0452c590780fab13601930de04c3426430ee4b93b2a3870357738e13b1d60aadd81df
                                                                                                                                                SSDEEP:196608:TgfL0sKYu/PaQL2rg+9eqH2AbUEOgvDDJf6Wv/VrxiWmo3sNushugauo0LRmVj:GQLKg+4qH2AoEOgv3Jx/VMW1sAgau3RK
                                                                                                                                                TLSH:9DB63391670208F5D5BA63BE59519E794732BC231328FBD703FCD99B1F072A0293AB91
                                                                                                                                                File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................................1.............-.............................................H.......H.......Rich...................

                                                                                                                                                File Icon

                                                                                                                                                Icon Hash:2e1e7c4c4c61e979

                                                                                                                                                Static PE Info

                                                                                                                                                General

                                                                                                                                                Entrypoint:0x14000a6a0
                                                                                                                                                Entrypoint Section:.text
                                                                                                                                                Digitally signed:false
                                                                                                                                                Imagebase:0x140000000
                                                                                                                                                Subsystem:windows cui
                                                                                                                                                Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                                                                                                                DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
                                                                                                                                                Time Stamp:0x65C8ED34 [Sun Feb 11 15:52:20 2024 UTC]
                                                                                                                                                TLS Callbacks:
                                                                                                                                                CLR (.Net) Version:
                                                                                                                                                OS Version Major:5
                                                                                                                                                OS Version Minor:2
                                                                                                                                                File Version Major:5
                                                                                                                                                File Version Minor:2
                                                                                                                                                Subsystem Version Major:5
                                                                                                                                                Subsystem Version Minor:2
                                                                                                                                                Import Hash:ba5546933531fafa869b1f86a4e2a959

                                                                                                                                                Entrypoint Preview

                                                                                                                                                Instruction
                                                                                                                                                dec eax
                                                                                                                                                sub esp, 28h
                                                                                                                                                call 00007F4874C5A05Ch
                                                                                                                                                dec eax
                                                                                                                                                add esp, 28h
                                                                                                                                                jmp 00007F4874C59C5Fh
                                                                                                                                                int3
                                                                                                                                                int3
                                                                                                                                                int3
                                                                                                                                                int3
                                                                                                                                                int3
                                                                                                                                                int3
                                                                                                                                                int3
                                                                                                                                                int3
                                                                                                                                                int3
                                                                                                                                                int3
                                                                                                                                                int3
                                                                                                                                                int3
                                                                                                                                                int3
                                                                                                                                                int3
                                                                                                                                                dec eax
                                                                                                                                                sub esp, 28h
                                                                                                                                                call 00007F4874C5A5A4h
                                                                                                                                                test eax, eax
                                                                                                                                                je 00007F4874C59E13h
                                                                                                                                                dec eax
                                                                                                                                                mov eax, dword ptr [00000030h]
                                                                                                                                                dec eax
                                                                                                                                                mov ecx, dword ptr [eax+08h]
                                                                                                                                                jmp 00007F4874C59DF7h
                                                                                                                                                dec eax
                                                                                                                                                cmp ecx, eax
                                                                                                                                                je 00007F4874C59E06h
                                                                                                                                                xor eax, eax
                                                                                                                                                dec eax
                                                                                                                                                cmpxchg dword ptr [00041E8Ch], ecx
                                                                                                                                                jne 00007F4874C59DE0h
                                                                                                                                                xor al, al
                                                                                                                                                dec eax
                                                                                                                                                add esp, 28h
                                                                                                                                                ret
                                                                                                                                                mov al, 01h
                                                                                                                                                jmp 00007F4874C59DE9h
                                                                                                                                                int3
                                                                                                                                                int3
                                                                                                                                                int3
                                                                                                                                                inc eax
                                                                                                                                                push ebx
                                                                                                                                                dec eax
                                                                                                                                                sub esp, 20h
                                                                                                                                                movzx eax, byte ptr [00041E77h]
                                                                                                                                                test ecx, ecx
                                                                                                                                                mov ebx, 00000001h
                                                                                                                                                cmove eax, ebx
                                                                                                                                                mov byte ptr [00041E67h], al
                                                                                                                                                call 00007F4874C5A3A3h
                                                                                                                                                call 00007F4874C5B4D2h
                                                                                                                                                test al, al
                                                                                                                                                jne 00007F4874C59DF6h
                                                                                                                                                xor al, al
                                                                                                                                                jmp 00007F4874C59E06h
                                                                                                                                                call 00007F4874C688B1h
                                                                                                                                                test al, al
                                                                                                                                                jne 00007F4874C59DFBh
                                                                                                                                                xor ecx, ecx
                                                                                                                                                call 00007F4874C5B4E2h
                                                                                                                                                jmp 00007F4874C59DDCh
                                                                                                                                                mov al, bl
                                                                                                                                                dec eax
                                                                                                                                                add esp, 20h
                                                                                                                                                pop ebx
                                                                                                                                                ret
                                                                                                                                                int3
                                                                                                                                                int3
                                                                                                                                                int3
                                                                                                                                                inc eax
                                                                                                                                                push ebx
                                                                                                                                                dec eax
                                                                                                                                                sub esp, 20h
                                                                                                                                                cmp byte ptr [00041E2Ch], 00000000h
                                                                                                                                                mov ebx, ecx
                                                                                                                                                jne 00007F4874C59E59h
                                                                                                                                                cmp ecx, 01h
                                                                                                                                                jnbe 00007F4874C59E5Ch
                                                                                                                                                call 00007F4874C5A50Ah
                                                                                                                                                test eax, eax
                                                                                                                                                je 00007F4874C59E1Ah

                                                                                                                                                Data Directories

                                                                                                                                                NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                IMAGE_DIRECTORY_ENTRY_IMPORT0x3bb940x3c.rdata
                                                                                                                                                IMAGE_DIRECTORY_ENTRY_RESOURCE0x520000xef8c.rsrc
                                                                                                                                                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x4e0000x20e8.pdata
                                                                                                                                                IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                IMAGE_DIRECTORY_ENTRY_BASERELOC0x610000x75c.reloc
                                                                                                                                                IMAGE_DIRECTORY_ENTRY_DEBUG0x393500x1c.rdata
                                                                                                                                                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x392100x140.rdata
                                                                                                                                                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                IMAGE_DIRECTORY_ENTRY_IAT0x2a0000x350.rdata
                                                                                                                                                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                Sections

                                                                                                                                                NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                .text0x10000x288900x28a007c71956ea75242f33df45f4d2c19a4d8False0.5562019230769231zlib compressed data6.489977853279916IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                .rdata0x2a0000x1271a0x12800cf9cb7b4c9af47cd1857b49383ba72c6False0.5159549197635135data5.84623965078296IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                .data0x3d0000x103f80xe009bd2cebaa3285e8e266c4c373a15119dFalse0.13337053571428573DOS executable (block device driver \377\3)1.808915577448681IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                .pdata0x4e0000x20e80x2200f2a57235499cb8c84daf2de6f18a85ebFalse0.4756433823529412data5.330974160786823IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                _RDATA0x510000x15c0x20032c20bb907888de565d4d8836d097016False0.392578125data2.795351059303424IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                .rsrc0x520000xef8c0xf000dabc2b77a65cf1196a989f49ae2bdf8dFalse0.8010091145833333data7.350146321781753IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                .reloc0x610000x75c0x800b7279c82d58eeae8dc663879402c6f2eFalse0.54296875data5.238892234772638IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                Resources

                                                                                                                                                NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                RT_ICON0x522080xea8Device independent bitmap graphic, 48 x 96 x 8, image size 00.56636460554371
                                                                                                                                                RT_ICON0x530b00x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 00.7287906137184116
                                                                                                                                                RT_ICON0x539580x568Device independent bitmap graphic, 16 x 32 x 8, image size 00.7471098265895953
                                                                                                                                                RT_ICON0x53ec00x909bPNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.9971636186822983
                                                                                                                                                RT_ICON0x5cf5c0x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 00.38309128630705397
                                                                                                                                                RT_ICON0x5f5040x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 00.4826454033771107
                                                                                                                                                RT_ICON0x605ac0x468Device independent bitmap graphic, 16 x 32 x 32, image size 00.699468085106383
                                                                                                                                                RT_GROUP_ICON0x60a140x68data0.7019230769230769
                                                                                                                                                RT_MANIFEST0x60a7c0x50dXML 1.0 document, ASCII text0.4694508894044857

                                                                                                                                                Imports

                                                                                                                                                DLLImport
                                                                                                                                                KERNEL32.dllGetCommandLineW, GetEnvironmentVariableW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, CreateDirectoryW, GetTempPathW, WaitForSingleObject, Sleep, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, LoadLibraryExW, SetConsoleCtrlHandler, FindClose, FindFirstFileExW, CloseHandle, GetCurrentProcess, LocalFree, FormatMessageW, MultiByteToWideChar, WideCharToMultiByte, WriteConsoleW, GetProcAddress, GetModuleFileNameW, SetDllDirectoryW, FreeLibrary, GetLastError, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetModuleHandleW, RtlUnwindEx, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, CreateFileW, GetDriveTypeW, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, GetFullPathNameW, RemoveDirectoryW, FindNextFileW, SetStdHandle, DeleteFileW, ReadFile, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW, GetCurrentDirectoryW, FlushFileBuffers, HeapReAlloc, GetFileAttributesExW, GetStringTypeW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, SetEndOfFile
                                                                                                                                                ADVAPI32.dllConvertSidToStringSidW, GetTokenInformation, OpenProcessToken, ConvertStringSecurityDescriptorToSecurityDescriptorW

                                                                                                                                                Network Behavior

                                                                                                                                                DNS Answers

                                                                                                                                                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                Apr 19, 2024 02:45:22.687341928 CEST1.1.1.1192.168.2.50x4702No error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                Apr 19, 2024 02:45:22.687341928 CEST1.1.1.1192.168.2.50x4702No error (0)fp2e7a.wpc.phicdn.net192.229.211.108A (IP address)IN (0x0001)false

                                                                                                                                                Statistics

                                                                                                                                                CPU Usage

                                                                                                                                                Click to jump to process

                                                                                                                                                Memory Usage

                                                                                                                                                Click to jump to process

                                                                                                                                                High Level Behavior Distribution

                                                                                                                                                Click to dive into process behavior distribution

                                                                                                                                                Behavior

                                                                                                                                                Click to jump to process

                                                                                                                                                System Behavior

                                                                                                                                                General

                                                                                                                                                Target ID:1
                                                                                                                                                Start time:02:45:46
                                                                                                                                                Start date:19/04/2024
                                                                                                                                                Path:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                Commandline:"C:\Users\user\Desktop\xSO7sbN2j6.exe"
                                                                                                                                                Imagebase:0x7ff73d7a0000
                                                                                                                                                File size:11'440'768 bytes
                                                                                                                                                MD5 hash:5917C8E5A003B2C211150D1F92440F79
                                                                                                                                                Has elevated privileges:true
                                                                                                                                                Has administrator privileges:true
                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                Reputation:low
                                                                                                                                                Has exited:true

                                                                                                                                                General

                                                                                                                                                Target ID:2
                                                                                                                                                Start time:02:45:46
                                                                                                                                                Start date:19/04/2024
                                                                                                                                                Path:C:\Windows\System32\conhost.exe
                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                Imagebase:0x7ff6d64d0000
                                                                                                                                                File size:862'208 bytes
                                                                                                                                                MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                Has elevated privileges:true
                                                                                                                                                Has administrator privileges:true
                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                Reputation:high
                                                                                                                                                Has exited:true

                                                                                                                                                General

                                                                                                                                                Target ID:3
                                                                                                                                                Start time:02:45:48
                                                                                                                                                Start date:19/04/2024
                                                                                                                                                Path:C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                Wow64 process (32bit):false
                                                                                                                                                Commandline:"C:\Users\user\Desktop\xSO7sbN2j6.exe"
                                                                                                                                                Imagebase:0x7ff73d7a0000
                                                                                                                                                File size:11'440'768 bytes
                                                                                                                                                MD5 hash:5917C8E5A003B2C211150D1F92440F79
                                                                                                                                                Has elevated privileges:true
                                                                                                                                                Has administrator privileges:true
                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                Reputation:low
                                                                                                                                                Has exited:true

                                                                                                                                                General

                                                                                                                                                Target ID:7
                                                                                                                                                Start time:02:46:05
                                                                                                                                                Start date:19/04/2024
                                                                                                                                                Path:C:\Users\user\AppData\Local\Temp\_MEI12682\exe\netconn_properties.exe
                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                Commandline:C:\Users\user\AppData\Local\Temp\_MEI12682\exe/netconn_properties.exe
                                                                                                                                                Imagebase:0xa00000
                                                                                                                                                File size:61'440 bytes
                                                                                                                                                MD5 hash:3B8E84142573A5E30990BDE2E574C447
                                                                                                                                                Has elevated privileges:true
                                                                                                                                                Has administrator privileges:true
                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                Reputation:low
                                                                                                                                                Has exited:true

                                                                                                                                                General

                                                                                                                                                Target ID:10
                                                                                                                                                Start time:02:46:05
                                                                                                                                                Start date:19/04/2024
                                                                                                                                                Path:C:\Users\user\AppData\Local\Temp\_MEI12682\exe\registers.exe
                                                                                                                                                Wow64 process (32bit):true
                                                                                                                                                Commandline:C:\Users\user\AppData\Local\Temp\_MEI12682\exe/registers.exe
                                                                                                                                                Imagebase:0x260000
                                                                                                                                                File size:11'264 bytes
                                                                                                                                                MD5 hash:527010682A02EE5935BAC5B2D074C49D
                                                                                                                                                Has elevated privileges:true
                                                                                                                                                Has administrator privileges:true
                                                                                                                                                Programmed in:C, C++ or other language
                                                                                                                                                Reputation:low
                                                                                                                                                Has exited:true

                                                                                                                                                Disassembly

                                                                                                                                                Reset < >

                                                                                                                                                  Execution Graph

                                                                                                                                                  Execution Coverage:11.6%
                                                                                                                                                  Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                  Signature Coverage:13.5%
                                                                                                                                                  Total number of Nodes:2000
                                                                                                                                                  Total number of Limit Nodes:62
                                                                                                                                                  execution_graph 18686 7ff73d7c0620 18704 7ff73d7bf808 EnterCriticalSection 18686->18704 18706 7ff73d7c7020 18709 7ff73d7c17b0 18706->18709 18710 7ff73d7c1802 18709->18710 18711 7ff73d7c17bd 18709->18711 18715 7ff73d7ba854 18711->18715 18716 7ff73d7ba880 FlsSetValue 18715->18716 18717 7ff73d7ba865 FlsGetValue 18715->18717 18718 7ff73d7ba872 18716->18718 18719 7ff73d7ba88d 18716->18719 18717->18718 18720 7ff73d7ba87a 18717->18720 18721 7ff73d7ba878 18718->18721 18722 7ff73d7b936c __FrameHandler3::FrameUnwindToEmptyState 45 API calls 18718->18722 18723 7ff73d7bdeb8 memcpy_s 11 API calls 18719->18723 18720->18716 18735 7ff73d7c1484 18721->18735 18724 7ff73d7ba8f5 18722->18724 18725 7ff73d7ba89c 18723->18725 18726 7ff73d7ba8ba FlsSetValue 18725->18726 18727 7ff73d7ba8aa FlsSetValue 18725->18727 18729 7ff73d7ba8c6 FlsSetValue 18726->18729 18730 7ff73d7ba8d8 18726->18730 18728 7ff73d7ba8b3 18727->18728 18731 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18728->18731 18729->18728 18732 7ff73d7ba524 memcpy_s 11 API calls 18730->18732 18731->18718 18733 7ff73d7ba8e0 18732->18733 18734 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18733->18734 18734->18721 18758 7ff73d7c16f4 18735->18758 18737 7ff73d7c14b9 18773 7ff73d7c1184 18737->18773 18740 7ff73d7c14d6 18740->18710 18741 7ff73d7bcc2c _fread_nolock 12 API calls 18742 7ff73d7c14e7 18741->18742 18743 7ff73d7c14ef 18742->18743 18745 7ff73d7c14fe 18742->18745 18744 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18743->18744 18744->18740 18745->18745 18780 7ff73d7c182c 18745->18780 18748 7ff73d7c15fa 18749 7ff73d7b6088 memcpy_s 11 API calls 18748->18749 18750 7ff73d7c15ff 18749->18750 18753 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18750->18753 18751 7ff73d7c1655 18752 7ff73d7c16bc 18751->18752 18791 7ff73d7c0fb4 18751->18791 18756 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18752->18756 18753->18740 18754 7ff73d7c1614 18754->18751 18757 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18754->18757 18756->18740 18757->18751 18759 7ff73d7c1717 18758->18759 18760 7ff73d7c1721 18759->18760 18806 7ff73d7bf808 EnterCriticalSection 18759->18806 18762 7ff73d7c1793 18760->18762 18765 7ff73d7b936c __FrameHandler3::FrameUnwindToEmptyState 45 API calls 18760->18765 18762->18737 18766 7ff73d7c17ab 18765->18766 18768 7ff73d7c1802 18766->18768 18770 7ff73d7ba854 50 API calls 18766->18770 18768->18737 18771 7ff73d7c17ec 18770->18771 18772 7ff73d7c1484 65 API calls 18771->18772 18772->18768 18774 7ff73d7b4a84 45 API calls 18773->18774 18775 7ff73d7c1198 18774->18775 18776 7ff73d7c11b6 18775->18776 18777 7ff73d7c11a4 GetOEMCP 18775->18777 18778 7ff73d7c11bb GetACP 18776->18778 18779 7ff73d7c11cb 18776->18779 18777->18779 18778->18779 18779->18740 18779->18741 18781 7ff73d7c1184 47 API calls 18780->18781 18782 7ff73d7c1859 18781->18782 18783 7ff73d7c19af 18782->18783 18784 7ff73d7c1896 IsValidCodePage 18782->18784 18790 7ff73d7c18b0 memcpy_s 18782->18790 18785 7ff73d7aa100 _wfindfirst32i64 8 API calls 18783->18785 18784->18783 18786 7ff73d7c18a7 18784->18786 18787 7ff73d7c15f1 18785->18787 18788 7ff73d7c18d6 GetCPInfo 18786->18788 18786->18790 18787->18748 18787->18754 18788->18783 18788->18790 18807 7ff73d7c129c 18790->18807 18878 7ff73d7bf808 EnterCriticalSection 18791->18878 18808 7ff73d7c12d9 GetCPInfo 18807->18808 18817 7ff73d7c13cf 18807->18817 18814 7ff73d7c12ec 18808->18814 18808->18817 18809 7ff73d7aa100 _wfindfirst32i64 8 API calls 18810 7ff73d7c146e 18809->18810 18810->18783 18818 7ff73d7c1fe0 18814->18818 18816 7ff73d7c6f84 54 API calls 18816->18817 18817->18809 18819 7ff73d7b4a84 45 API calls 18818->18819 18820 7ff73d7c2022 18819->18820 18821 7ff73d7be870 _fread_nolock MultiByteToWideChar 18820->18821 18823 7ff73d7c2058 18821->18823 18822 7ff73d7c205f 18825 7ff73d7aa100 _wfindfirst32i64 8 API calls 18822->18825 18823->18822 18824 7ff73d7c2088 memcpy_s 18823->18824 18826 7ff73d7bcc2c _fread_nolock 12 API calls 18823->18826 18828 7ff73d7c211c 18823->18828 18824->18828 18830 7ff73d7be870 _fread_nolock MultiByteToWideChar 18824->18830 18827 7ff73d7c1363 18825->18827 18826->18824 18833 7ff73d7c6f84 18827->18833 18828->18822 18829 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18828->18829 18829->18822 18831 7ff73d7c20fe 18830->18831 18831->18828 18832 7ff73d7c2102 GetStringTypeW 18831->18832 18832->18828 18834 7ff73d7b4a84 45 API calls 18833->18834 18835 7ff73d7c6fa9 18834->18835 18838 7ff73d7c6c50 18835->18838 18839 7ff73d7c6c91 18838->18839 18840 7ff73d7be870 _fread_nolock MultiByteToWideChar 18839->18840 18844 7ff73d7c6cdb 18840->18844 18841 7ff73d7c6f59 18843 7ff73d7aa100 _wfindfirst32i64 8 API calls 18841->18843 18842 7ff73d7c6e11 18842->18841 18847 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18842->18847 18845 7ff73d7c1396 18843->18845 18844->18841 18844->18842 18846 7ff73d7bcc2c _fread_nolock 12 API calls 18844->18846 18848 7ff73d7c6d13 18844->18848 18845->18816 18846->18848 18847->18841 18848->18842 18849 7ff73d7be870 _fread_nolock MultiByteToWideChar 18848->18849 18850 7ff73d7c6d86 18849->18850 18850->18842 18869 7ff73d7be304 18850->18869 18853 7ff73d7c6e22 18855 7ff73d7bcc2c _fread_nolock 12 API calls 18853->18855 18857 7ff73d7c6ef4 18853->18857 18858 7ff73d7c6e40 18853->18858 18854 7ff73d7c6dd1 18854->18842 18856 7ff73d7be304 __crtLCMapStringW 6 API calls 18854->18856 18855->18858 18856->18842 18857->18842 18859 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18857->18859 18858->18842 18860 7ff73d7be304 __crtLCMapStringW 6 API calls 18858->18860 18859->18842 18861 7ff73d7c6ec0 18860->18861 18861->18857 18862 7ff73d7c6ee0 18861->18862 18863 7ff73d7c6ef6 18861->18863 18864 7ff73d7bf138 WideCharToMultiByte 18862->18864 18865 7ff73d7bf138 WideCharToMultiByte 18863->18865 18866 7ff73d7c6eee 18864->18866 18865->18866 18866->18857 18867 7ff73d7c6f0e 18866->18867 18867->18842 18868 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18867->18868 18868->18842 18870 7ff73d7bdf30 __crtLCMapStringW 5 API calls 18869->18870 18871 7ff73d7be342 18870->18871 18872 7ff73d7be34a 18871->18872 18875 7ff73d7be3f0 18871->18875 18872->18842 18872->18853 18872->18854 18874 7ff73d7be3b3 LCMapStringW 18874->18872 18876 7ff73d7bdf30 __crtLCMapStringW 5 API calls 18875->18876 18877 7ff73d7be41e __crtLCMapStringW 18876->18877 18877->18874 15105 7ff73d7b8919 15117 7ff73d7b9238 15105->15117 15122 7ff73d7ba780 GetLastError 15117->15122 15123 7ff73d7ba7c1 FlsSetValue 15122->15123 15124 7ff73d7ba7a4 FlsGetValue 15122->15124 15126 7ff73d7ba7d3 15123->15126 15141 7ff73d7ba7b1 15123->15141 15125 7ff73d7ba7bb 15124->15125 15124->15141 15125->15123 15127 7ff73d7bdeb8 memcpy_s 11 API calls 15126->15127 15129 7ff73d7ba7e2 15127->15129 15128 7ff73d7ba82d SetLastError 15130 7ff73d7b9241 15128->15130 15131 7ff73d7ba84d 15128->15131 15132 7ff73d7ba800 FlsSetValue 15129->15132 15133 7ff73d7ba7f0 FlsSetValue 15129->15133 15144 7ff73d7b936c 15130->15144 15134 7ff73d7b936c __FrameHandler3::FrameUnwindToEmptyState 38 API calls 15131->15134 15137 7ff73d7ba81e 15132->15137 15138 7ff73d7ba80c FlsSetValue 15132->15138 15136 7ff73d7ba7f9 15133->15136 15135 7ff73d7ba852 15134->15135 15139 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15136->15139 15140 7ff73d7ba524 memcpy_s 11 API calls 15137->15140 15138->15136 15139->15141 15142 7ff73d7ba826 15140->15142 15141->15128 15143 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15142->15143 15143->15128 15153 7ff73d7c27f0 15144->15153 15187 7ff73d7c27a8 15153->15187 15192 7ff73d7bf808 EnterCriticalSection 15187->15192 15384 7ff73d7aa51c 15405 7ff73d7aa6fc 15384->15405 15387 7ff73d7aa673 15512 7ff73d7aaa2c IsProcessorFeaturePresent 15387->15512 15388 7ff73d7aa53d __scrt_acquire_startup_lock 15390 7ff73d7aa67d 15388->15390 15395 7ff73d7aa55b __scrt_release_startup_lock 15388->15395 15391 7ff73d7aaa2c 7 API calls 15390->15391 15393 7ff73d7aa688 __FrameHandler3::FrameUnwindToEmptyState 15391->15393 15392 7ff73d7aa580 15394 7ff73d7aa606 15413 7ff73d7b8738 15394->15413 15395->15392 15395->15394 15501 7ff73d7b8ae4 15395->15501 15398 7ff73d7aa60b 15419 7ff73d7a1000 15398->15419 15402 7ff73d7aa62f 15402->15393 15508 7ff73d7aa890 15402->15508 15519 7ff73d7aaccc 15405->15519 15408 7ff73d7aa535 15408->15387 15408->15388 15409 7ff73d7aa72b 15521 7ff73d7b91ec 15409->15521 15414 7ff73d7b8748 15413->15414 15417 7ff73d7b875d 15413->15417 15414->15417 15564 7ff73d7b81c8 15414->15564 15417->15398 15420 7ff73d7a1011 15419->15420 15617 7ff73d7a67c0 15420->15617 15422 7ff73d7a1023 15624 7ff73d7b4f7c 15422->15624 15424 7ff73d7a27ab 15631 7ff73d7a1af0 15424->15631 15428 7ff73d7aa100 _wfindfirst32i64 8 API calls 15429 7ff73d7a28de 15428->15429 15506 7ff73d7aab80 GetModuleHandleW 15429->15506 15430 7ff73d7a27c9 15460 7ff73d7a28ca 15430->15460 15647 7ff73d7a2c50 15430->15647 15432 7ff73d7a27fb 15432->15460 15650 7ff73d7a5af0 15432->15650 15434 7ff73d7a2817 15435 7ff73d7a2863 15434->15435 15437 7ff73d7a5af0 92 API calls 15434->15437 15665 7ff73d7a60f0 15435->15665 15442 7ff73d7a2838 __std_exception_destroy 15437->15442 15438 7ff73d7a2878 15669 7ff73d7a19d0 15438->15669 15441 7ff73d7a296d 15444 7ff73d7a2998 15441->15444 15791 7ff73d7a24a0 15441->15791 15442->15435 15447 7ff73d7a60f0 89 API calls 15442->15447 15443 7ff73d7a19d0 121 API calls 15446 7ff73d7a28ae 15443->15446 15452 7ff73d7a29db 15444->15452 15680 7ff73d7a6db0 15444->15680 15450 7ff73d7a28f0 15446->15450 15451 7ff73d7a28b2 15446->15451 15447->15435 15449 7ff73d7a29b8 15453 7ff73d7a29ce SetDllDirectoryW 15449->15453 15454 7ff73d7a29bd 15449->15454 15450->15441 15768 7ff73d7a2de0 15450->15768 15762 7ff73d7a1c50 15451->15762 15694 7ff73d7a4fa0 15452->15694 15453->15452 15457 7ff73d7a1c50 86 API calls 15454->15457 15457->15460 15460->15428 15462 7ff73d7a2912 15467 7ff73d7a1c50 86 API calls 15462->15467 15463 7ff73d7a2a36 15470 7ff73d7a2af6 15463->15470 15476 7ff73d7a2a49 15463->15476 15466 7ff73d7a2940 15466->15441 15469 7ff73d7a2945 15466->15469 15467->15460 15468 7ff73d7a29f8 15468->15463 15805 7ff73d7a47a0 15468->15805 15787 7ff73d7ae60c 15469->15787 15698 7ff73d7a2330 15470->15698 15485 7ff73d7a2a95 15476->15485 15899 7ff73d7a1b30 15476->15899 15477 7ff73d7a2a2c 15482 7ff73d7a49f0 FreeLibrary 15477->15482 15478 7ff73d7a2a0d 15825 7ff73d7a4730 15478->15825 15482->15463 15483 7ff73d7a2a17 15483->15477 15486 7ff73d7a2a1b 15483->15486 15484 7ff73d7a2b2b 15487 7ff73d7a5af0 92 API calls 15484->15487 15485->15460 15903 7ff73d7a22d0 15485->15903 15893 7ff73d7a4df0 15486->15893 15492 7ff73d7a2b37 15487->15492 15490 7ff73d7a2ad1 15493 7ff73d7a49f0 FreeLibrary 15490->15493 15492->15460 15715 7ff73d7a6130 15492->15715 15493->15460 15502 7ff73d7b8b1c 15501->15502 15503 7ff73d7b8afb 15501->15503 15504 7ff73d7b9238 45 API calls 15502->15504 15503->15394 15505 7ff73d7b8b21 15504->15505 15507 7ff73d7aab91 15506->15507 15507->15402 15509 7ff73d7aa8a1 15508->15509 15510 7ff73d7aa646 15509->15510 15511 7ff73d7abe28 __scrt_initialize_crt 7 API calls 15509->15511 15510->15392 15511->15510 15513 7ff73d7aaa52 _wfindfirst32i64 memcpy_s 15512->15513 15514 7ff73d7aaa71 RtlCaptureContext RtlLookupFunctionEntry 15513->15514 15515 7ff73d7aaad6 memcpy_s 15514->15515 15516 7ff73d7aaa9a RtlVirtualUnwind 15514->15516 15517 7ff73d7aab08 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 15515->15517 15516->15515 15518 7ff73d7aab5a _wfindfirst32i64 15517->15518 15518->15390 15520 7ff73d7aa71e __scrt_dllmain_crt_thread_attach 15519->15520 15520->15408 15520->15409 15523 7ff73d7c264c 15521->15523 15522 7ff73d7aa730 15522->15408 15525 7ff73d7abe28 15522->15525 15523->15522 15531 7ff73d7bbb50 15523->15531 15526 7ff73d7abe30 15525->15526 15527 7ff73d7abe3a 15525->15527 15543 7ff73d7ac1a4 15526->15543 15527->15408 15542 7ff73d7bf808 EnterCriticalSection 15531->15542 15544 7ff73d7ac1b3 15543->15544 15546 7ff73d7abe35 15543->15546 15551 7ff73d7ac3e0 15544->15551 15547 7ff73d7ac210 15546->15547 15548 7ff73d7ac23b 15547->15548 15549 7ff73d7ac23f 15548->15549 15550 7ff73d7ac21e DeleteCriticalSection 15548->15550 15549->15527 15550->15548 15555 7ff73d7ac248 15551->15555 15556 7ff73d7ac28c __vcrt_InitializeCriticalSectionEx 15555->15556 15562 7ff73d7ac362 TlsFree 15555->15562 15557 7ff73d7ac2ba LoadLibraryExW 15556->15557 15558 7ff73d7ac351 GetProcAddress 15556->15558 15556->15562 15563 7ff73d7ac2fd LoadLibraryExW 15556->15563 15559 7ff73d7ac331 15557->15559 15560 7ff73d7ac2db GetLastError 15557->15560 15558->15562 15559->15558 15561 7ff73d7ac348 FreeLibrary 15559->15561 15560->15556 15561->15558 15563->15556 15563->15559 15565 7ff73d7b81e1 15564->15565 15566 7ff73d7b81dd 15564->15566 15585 7ff73d7c1bfc GetEnvironmentStringsW 15565->15585 15566->15417 15577 7ff73d7b8588 15566->15577 15569 7ff73d7b81fa 15592 7ff73d7b8348 15569->15592 15570 7ff73d7b81ee 15572 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15570->15572 15572->15566 15574 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15575 7ff73d7b8221 15574->15575 15576 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15575->15576 15576->15566 15578 7ff73d7b85ab 15577->15578 15579 7ff73d7b85c2 15577->15579 15578->15417 15579->15578 15580 7ff73d7bdeb8 memcpy_s 11 API calls 15579->15580 15581 7ff73d7b8636 15579->15581 15582 7ff73d7be870 MultiByteToWideChar _fread_nolock 15579->15582 15584 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15579->15584 15580->15579 15583 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15581->15583 15582->15579 15583->15578 15584->15579 15586 7ff73d7c1c20 15585->15586 15587 7ff73d7b81e6 15585->15587 15588 7ff73d7bcc2c _fread_nolock 12 API calls 15586->15588 15587->15569 15587->15570 15589 7ff73d7c1c57 memcpy_s 15588->15589 15590 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15589->15590 15591 7ff73d7c1c77 FreeEnvironmentStringsW 15590->15591 15591->15587 15593 7ff73d7b8370 15592->15593 15594 7ff73d7bdeb8 memcpy_s 11 API calls 15593->15594 15607 7ff73d7b83ab 15594->15607 15595 7ff73d7b83b3 15596 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15595->15596 15597 7ff73d7b8202 15596->15597 15597->15574 15598 7ff73d7b842d 15599 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15598->15599 15599->15597 15600 7ff73d7bdeb8 memcpy_s 11 API calls 15600->15607 15601 7ff73d7b841c 15611 7ff73d7b8464 15601->15611 15603 7ff73d7bf9a4 _wfindfirst32i64 37 API calls 15603->15607 15605 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15605->15595 15606 7ff73d7b8450 15608 7ff73d7b9f30 _wfindfirst32i64 17 API calls 15606->15608 15607->15595 15607->15598 15607->15600 15607->15601 15607->15603 15607->15606 15609 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15607->15609 15610 7ff73d7b8462 15608->15610 15609->15607 15615 7ff73d7b8469 15611->15615 15616 7ff73d7b8424 15611->15616 15612 7ff73d7b8492 15614 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15612->15614 15613 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15613->15615 15614->15616 15615->15612 15615->15613 15616->15605 15619 7ff73d7a67df 15617->15619 15618 7ff73d7a6830 WideCharToMultiByte 15618->15619 15621 7ff73d7a68d8 15618->15621 15619->15618 15619->15621 15622 7ff73d7a6886 WideCharToMultiByte 15619->15622 15623 7ff73d7a67e7 __std_exception_destroy 15619->15623 15931 7ff73d7a1cb0 15621->15931 15622->15619 15622->15621 15623->15422 15627 7ff73d7becc0 15624->15627 15625 7ff73d7bed13 15626 7ff73d7b9e44 _invalid_parameter_noinfo 37 API calls 15625->15626 15630 7ff73d7bed3c 15626->15630 15627->15625 15628 7ff73d7bed66 15627->15628 16259 7ff73d7beb98 15628->16259 15630->15424 15632 7ff73d7a1b05 15631->15632 15633 7ff73d7a1b20 15632->15633 16267 7ff73d7a1c10 15632->16267 15633->15460 15635 7ff73d7a2cd0 15633->15635 16290 7ff73d7aa130 15635->16290 15638 7ff73d7a2d22 16292 7ff73d7a6ec0 15638->16292 15639 7ff73d7a2d0b 15640 7ff73d7a1cb0 86 API calls 15639->15640 15642 7ff73d7a2d1e 15640->15642 15645 7ff73d7aa100 _wfindfirst32i64 8 API calls 15642->15645 15644 7ff73d7a1c50 86 API calls 15644->15642 15646 7ff73d7a2d5f 15645->15646 15646->15430 15648 7ff73d7a1b30 49 API calls 15647->15648 15649 7ff73d7a2c6d 15648->15649 15649->15432 15651 7ff73d7a5afa 15650->15651 15652 7ff73d7a6db0 88 API calls 15651->15652 15653 7ff73d7a5b1c GetEnvironmentVariableW 15652->15653 15654 7ff73d7a5b34 ExpandEnvironmentStringsW 15653->15654 15655 7ff73d7a5b86 15653->15655 15656 7ff73d7a6ec0 88 API calls 15654->15656 15657 7ff73d7aa100 _wfindfirst32i64 8 API calls 15655->15657 15658 7ff73d7a5b5c 15656->15658 15659 7ff73d7a5b98 15657->15659 15658->15655 15660 7ff73d7a5b66 15658->15660 15659->15434 16303 7ff73d7b926c 15660->16303 15663 7ff73d7aa100 _wfindfirst32i64 8 API calls 15664 7ff73d7a5b7e 15663->15664 15664->15434 15666 7ff73d7a6db0 88 API calls 15665->15666 15667 7ff73d7a6107 SetEnvironmentVariableW 15666->15667 15668 7ff73d7a611f __std_exception_destroy 15667->15668 15668->15438 15670 7ff73d7a1b30 49 API calls 15669->15670 15671 7ff73d7a1a00 15670->15671 15672 7ff73d7a1b30 49 API calls 15671->15672 15678 7ff73d7a1a7a 15671->15678 15673 7ff73d7a1a22 15672->15673 15674 7ff73d7a2c50 49 API calls 15673->15674 15673->15678 15675 7ff73d7a1a3b 15674->15675 16310 7ff73d7a17b0 15675->16310 15678->15441 15678->15443 15679 7ff73d7ae60c 74 API calls 15679->15678 15681 7ff73d7a6dd1 MultiByteToWideChar 15680->15681 15682 7ff73d7a6e57 MultiByteToWideChar 15680->15682 15683 7ff73d7a6df7 15681->15683 15687 7ff73d7a6e1c 15681->15687 15684 7ff73d7a6e9f 15682->15684 15685 7ff73d7a6e7a 15682->15685 15686 7ff73d7a1cb0 86 API calls 15683->15686 15684->15449 15688 7ff73d7a1cb0 86 API calls 15685->15688 15689 7ff73d7a6e0a 15686->15689 15687->15682 15691 7ff73d7a6e32 15687->15691 15690 7ff73d7a6e8d 15688->15690 15689->15449 15690->15449 15692 7ff73d7a1cb0 86 API calls 15691->15692 15693 7ff73d7a6e45 15692->15693 15693->15449 15695 7ff73d7a4fb5 15694->15695 15696 7ff73d7a1c10 86 API calls 15695->15696 15697 7ff73d7a29e0 15695->15697 15696->15697 15697->15463 15795 7ff73d7a4c40 15697->15795 15699 7ff73d7a23e4 15698->15699 15707 7ff73d7a23a3 15698->15707 15700 7ff73d7a2423 15699->15700 15701 7ff73d7a1ab0 74 API calls 15699->15701 15702 7ff73d7aa100 _wfindfirst32i64 8 API calls 15700->15702 15701->15699 15703 7ff73d7a2435 15702->15703 15703->15460 15708 7ff73d7a6080 15703->15708 15707->15699 16383 7ff73d7a1440 15707->16383 16417 7ff73d7a1dc0 15707->16417 16472 7ff73d7a1780 15707->16472 15709 7ff73d7a6db0 88 API calls 15708->15709 15710 7ff73d7a609f 15709->15710 15711 7ff73d7a6db0 88 API calls 15710->15711 15712 7ff73d7a60af 15711->15712 15713 7ff73d7b6818 38 API calls 15712->15713 15714 7ff73d7a60bd __std_exception_destroy 15713->15714 15714->15484 15716 7ff73d7a6140 15715->15716 15717 7ff73d7a6db0 88 API calls 15716->15717 15718 7ff73d7a6171 SetConsoleCtrlHandler GetStartupInfoW 15717->15718 15719 7ff73d7a61d2 15718->15719 17326 7ff73d7b92e4 15719->17326 15723 7ff73d7a61e1 15724 7ff73d7b92e4 _fread_nolock 37 API calls 15723->15724 15725 7ff73d7a6200 15724->15725 15726 7ff73d7b705c _fread_nolock 37 API calls 15725->15726 15727 7ff73d7a6207 15726->15727 15728 7ff73d7b92e4 _fread_nolock 37 API calls 15727->15728 15729 7ff73d7a6227 15728->15729 15763 7ff73d7a1c6e 15762->15763 15764 7ff73d7a1b90 78 API calls 15763->15764 15765 7ff73d7a1c8c 15764->15765 15766 7ff73d7a1d00 86 API calls 15765->15766 15767 7ff73d7a1c9b 15766->15767 15767->15460 15769 7ff73d7a2dec 15768->15769 15770 7ff73d7a6db0 88 API calls 15769->15770 15771 7ff73d7a2e17 15770->15771 15772 7ff73d7a6db0 88 API calls 15771->15772 15773 7ff73d7a2e2a 15772->15773 17382 7ff73d7b5538 15773->17382 15776 7ff73d7aa100 _wfindfirst32i64 8 API calls 15777 7ff73d7a290a 15776->15777 15777->15462 15778 7ff73d7a6360 15777->15778 15779 7ff73d7a6384 15778->15779 15780 7ff73d7a645b __std_exception_destroy 15779->15780 15781 7ff73d7aec94 73 API calls 15779->15781 15780->15466 15782 7ff73d7a639e 15781->15782 15782->15780 17761 7ff73d7b7a9c 15782->17761 15784 7ff73d7a63b3 15784->15780 15785 7ff73d7aec94 73 API calls 15784->15785 15786 7ff73d7ae95c _fread_nolock 53 API calls 15784->15786 15785->15784 15786->15784 15788 7ff73d7ae63c 15787->15788 17776 7ff73d7ae3e8 15788->17776 15790 7ff73d7ae655 15790->15462 15792 7ff73d7a24e0 15791->15792 15794 7ff73d7a24b7 15791->15794 15792->15444 15793 7ff73d7a1780 86 API calls 15793->15794 15794->15792 15794->15793 15796 7ff73d7a4c64 15795->15796 15800 7ff73d7a4c91 15795->15800 15797 7ff73d7a4c8c 15796->15797 15798 7ff73d7a1780 86 API calls 15796->15798 15796->15800 15804 7ff73d7a4c87 memcpy_s __std_exception_destroy 15796->15804 17787 7ff73d7a12b0 15797->17787 15798->15796 15800->15804 17813 7ff73d7a2e60 15800->17813 15802 7ff73d7a4cf7 15803 7ff73d7a1c50 86 API calls 15802->15803 15802->15804 15803->15804 15804->15468 15818 7ff73d7a47ba memcpy_s 15805->15818 15807 7ff73d7a48df 15809 7ff73d7a2e60 49 API calls 15807->15809 15808 7ff73d7a48fb 15810 7ff73d7a1c50 86 API calls 15808->15810 15811 7ff73d7a4958 15809->15811 15816 7ff73d7a48f1 __std_exception_destroy 15810->15816 15814 7ff73d7a2e60 49 API calls 15811->15814 15812 7ff73d7a2e60 49 API calls 15812->15818 15813 7ff73d7a48c0 15813->15807 15817 7ff73d7a2e60 49 API calls 15813->15817 15815 7ff73d7a4988 15814->15815 15821 7ff73d7a2e60 49 API calls 15815->15821 15819 7ff73d7aa100 _wfindfirst32i64 8 API calls 15816->15819 15817->15807 15818->15807 15818->15808 15818->15812 15818->15813 15818->15818 15822 7ff73d7a1440 158 API calls 15818->15822 15823 7ff73d7a48e1 15818->15823 17816 7ff73d7a1650 15818->17816 15820 7ff73d7a2a09 15819->15820 15820->15477 15820->15478 15821->15816 15822->15818 15824 7ff73d7a1c50 86 API calls 15823->15824 15824->15816 17821 7ff73d7a6310 15825->17821 15827 7ff73d7a4742 15828 7ff73d7a6310 89 API calls 15827->15828 15829 7ff73d7a4755 15828->15829 15830 7ff73d7a477a 15829->15830 15831 7ff73d7a476d GetProcAddress 15829->15831 15832 7ff73d7a1c50 86 API calls 15830->15832 15835 7ff73d7a50d9 15831->15835 15836 7ff73d7a50fc GetProcAddress 15831->15836 15834 7ff73d7a4786 15832->15834 15834->15483 15838 7ff73d7a1cb0 86 API calls 15835->15838 15836->15835 15837 7ff73d7a5121 GetProcAddress 15836->15837 15837->15835 15839 7ff73d7a5146 GetProcAddress 15837->15839 15840 7ff73d7a50ec 15838->15840 15839->15835 15841 7ff73d7a516e GetProcAddress 15839->15841 15840->15483 15841->15835 15842 7ff73d7a5196 GetProcAddress 15841->15842 15842->15835 15843 7ff73d7a51be GetProcAddress 15842->15843 15844 7ff73d7a51e6 GetProcAddress 15843->15844 15845 7ff73d7a51da 15843->15845 15846 7ff73d7a5202 15844->15846 15847 7ff73d7a520e GetProcAddress 15844->15847 15845->15844 15846->15847 15848 7ff73d7a5236 GetProcAddress 15847->15848 15849 7ff73d7a522a 15847->15849 15850 7ff73d7a5252 15848->15850 15851 7ff73d7a525e GetProcAddress 15848->15851 15849->15848 15850->15851 15852 7ff73d7a5286 GetProcAddress 15851->15852 15853 7ff73d7a527a 15851->15853 15854 7ff73d7a52a2 15852->15854 15855 7ff73d7a52ae GetProcAddress 15852->15855 15853->15852 15854->15855 15856 7ff73d7a52d6 GetProcAddress 15855->15856 15857 7ff73d7a52ca 15855->15857 15857->15856 15894 7ff73d7a4e14 15893->15894 15895 7ff73d7a1c50 86 API calls 15894->15895 15898 7ff73d7a2a2a 15894->15898 15896 7ff73d7a4e6e 15895->15896 15897 7ff73d7a49f0 FreeLibrary 15896->15897 15897->15898 15898->15463 15900 7ff73d7a1b55 15899->15900 15901 7ff73d7b3c80 49 API calls 15900->15901 15902 7ff73d7a1b78 15901->15902 15902->15485 17825 7ff73d7a3ac0 15903->17825 15906 7ff73d7a231d 15906->15490 15908 7ff73d7a22f4 15908->15906 17881 7ff73d7a3840 15908->17881 15910 7ff73d7a2300 15910->15906 17891 7ff73d7a39a0 15910->17891 15912 7ff73d7a230c 15912->15906 15913 7ff73d7a2547 15912->15913 15914 7ff73d7a255c 15912->15914 15915 7ff73d7a1c50 86 API calls 15913->15915 15916 7ff73d7a257c 15914->15916 15928 7ff73d7a2592 __std_exception_destroy 15914->15928 15920 7ff73d7a2553 15915->15920 15918 7ff73d7a1c50 86 API calls 15916->15918 15918->15920 15921 7ff73d7a12b0 120 API calls 15921->15928 15922 7ff73d7a1780 86 API calls 15922->15928 15923 7ff73d7a1b30 49 API calls 15923->15928 15924 7ff73d7a273f 15926 7ff73d7a2719 15928->15920 15928->15921 15928->15922 15928->15923 15928->15924 15928->15926 15929 7ff73d7a26f6 15928->15929 15938 7ff73d7a1d00 15931->15938 15939 7ff73d7a1d10 15938->15939 15963 7ff73d7b3c80 15939->15963 15943 7ff73d7a1d70 15996 7ff73d7a1b90 15943->15996 15946 7ff73d7aa100 _wfindfirst32i64 8 API calls 15947 7ff73d7a1cd7 GetLastError 15946->15947 15948 7ff73d7a6670 15947->15948 15949 7ff73d7a667c 15948->15949 15950 7ff73d7a6697 GetLastError 15949->15950 15951 7ff73d7a669d FormatMessageW 15949->15951 15950->15951 15952 7ff73d7a66d0 15951->15952 15953 7ff73d7a66ec WideCharToMultiByte 15951->15953 15954 7ff73d7a1cb0 83 API calls 15952->15954 15955 7ff73d7a66e3 15953->15955 15956 7ff73d7a6726 15953->15956 15954->15955 15958 7ff73d7aa100 _wfindfirst32i64 8 API calls 15955->15958 15957 7ff73d7a1cb0 83 API calls 15956->15957 15957->15955 15959 7ff73d7a1ce4 15958->15959 15960 7ff73d7a1be0 15959->15960 15961 7ff73d7a1d00 86 API calls 15960->15961 15962 7ff73d7a1c02 15961->15962 15962->15623 15966 7ff73d7b3cda 15963->15966 15964 7ff73d7b3cff 15965 7ff73d7b9e44 _invalid_parameter_noinfo 37 API calls 15964->15965 15969 7ff73d7b3d29 15965->15969 15966->15964 15967 7ff73d7b3d3b 15966->15967 16000 7ff73d7b16c4 15967->16000 15972 7ff73d7aa100 _wfindfirst32i64 8 API calls 15969->15972 15970 7ff73d7b3e18 15971 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15970->15971 15971->15969 15973 7ff73d7a1d58 15972->15973 15981 7ff73d7a6bf0 MultiByteToWideChar 15973->15981 15975 7ff73d7b3ded 15977 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15975->15977 15976 7ff73d7b3e3c 15976->15970 15979 7ff73d7b3e46 15976->15979 15977->15969 15978 7ff73d7b3de4 15978->15970 15978->15975 15980 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 15979->15980 15980->15969 15982 7ff73d7a6c53 15981->15982 15983 7ff73d7a6c39 15981->15983 15985 7ff73d7a6c83 MultiByteToWideChar 15982->15985 15986 7ff73d7a6c69 15982->15986 15984 7ff73d7a1cb0 82 API calls 15983->15984 15995 7ff73d7a6c4c __std_exception_destroy 15984->15995 15988 7ff73d7a6cc0 WideCharToMultiByte 15985->15988 15989 7ff73d7a6ca6 15985->15989 15987 7ff73d7a1cb0 82 API calls 15986->15987 15987->15995 15990 7ff73d7a6cf6 15988->15990 15993 7ff73d7a6ced 15988->15993 15991 7ff73d7a1cb0 82 API calls 15989->15991 15992 7ff73d7a6d1b WideCharToMultiByte 15990->15992 15990->15993 15991->15995 15992->15993 15992->15995 15994 7ff73d7a1cb0 82 API calls 15993->15994 15994->15995 15995->15943 15997 7ff73d7a1bb6 15996->15997 16244 7ff73d7b3b5c 15997->16244 15999 7ff73d7a1bcc 15999->15946 16001 7ff73d7b1702 16000->16001 16002 7ff73d7b16f2 16000->16002 16003 7ff73d7b170b 16001->16003 16010 7ff73d7b1739 16001->16010 16004 7ff73d7b9e44 _invalid_parameter_noinfo 37 API calls 16002->16004 16005 7ff73d7b9e44 _invalid_parameter_noinfo 37 API calls 16003->16005 16006 7ff73d7b1731 16004->16006 16005->16006 16006->15970 16006->15975 16006->15976 16006->15978 16009 7ff73d7b19e8 16012 7ff73d7b9e44 _invalid_parameter_noinfo 37 API calls 16009->16012 16010->16002 16010->16006 16010->16009 16014 7ff73d7b2614 16010->16014 16040 7ff73d7b1ea4 16010->16040 16070 7ff73d7b120c 16010->16070 16073 7ff73d7b3830 16010->16073 16012->16002 16015 7ff73d7b2656 16014->16015 16016 7ff73d7b26c9 16014->16016 16017 7ff73d7b26f3 16015->16017 16018 7ff73d7b265c 16015->16018 16019 7ff73d7b2723 16016->16019 16020 7ff73d7b26ce 16016->16020 16097 7ff73d7b0150 16017->16097 16022 7ff73d7b2732 16018->16022 16027 7ff73d7b2661 16018->16027 16019->16017 16019->16022 16038 7ff73d7b268c 16019->16038 16021 7ff73d7b2703 16020->16021 16025 7ff73d7b26d0 16020->16025 16104 7ff73d7afd40 16021->16104 16039 7ff73d7b2761 16022->16039 16111 7ff73d7b0560 16022->16111 16029 7ff73d7b2671 16025->16029 16031 7ff73d7b26df 16025->16031 16027->16029 16030 7ff73d7b26a4 16027->16030 16027->16038 16029->16039 16079 7ff73d7b2f78 16029->16079 16030->16039 16089 7ff73d7b3434 16030->16089 16031->16017 16033 7ff73d7b26e4 16031->16033 16033->16039 16093 7ff73d7b35cc 16033->16093 16034 7ff73d7aa100 _wfindfirst32i64 8 API calls 16036 7ff73d7b29f7 16034->16036 16036->16010 16038->16039 16118 7ff73d7bdb60 16038->16118 16039->16034 16041 7ff73d7b1eaf 16040->16041 16042 7ff73d7b1ec5 16040->16042 16043 7ff73d7b2656 16041->16043 16044 7ff73d7b26c9 16041->16044 16048 7ff73d7b1f03 16041->16048 16045 7ff73d7b9e44 _invalid_parameter_noinfo 37 API calls 16042->16045 16042->16048 16046 7ff73d7b26f3 16043->16046 16047 7ff73d7b265c 16043->16047 16049 7ff73d7b2723 16044->16049 16050 7ff73d7b26ce 16044->16050 16045->16048 16055 7ff73d7b0150 38 API calls 16046->16055 16051 7ff73d7b2661 16047->16051 16054 7ff73d7b2732 16047->16054 16048->16010 16049->16046 16049->16054 16068 7ff73d7b268c 16049->16068 16052 7ff73d7b26d0 16050->16052 16053 7ff73d7b2703 16050->16053 16060 7ff73d7b2671 16051->16060 16061 7ff73d7b26a4 16051->16061 16051->16068 16059 7ff73d7b26df 16052->16059 16052->16060 16056 7ff73d7afd40 38 API calls 16053->16056 16058 7ff73d7b0560 38 API calls 16054->16058 16069 7ff73d7b2761 16054->16069 16055->16068 16056->16068 16057 7ff73d7b2f78 47 API calls 16057->16068 16058->16068 16059->16046 16063 7ff73d7b26e4 16059->16063 16060->16057 16060->16069 16062 7ff73d7b3434 47 API calls 16061->16062 16061->16069 16062->16068 16065 7ff73d7b35cc 37 API calls 16063->16065 16063->16069 16064 7ff73d7aa100 _wfindfirst32i64 8 API calls 16066 7ff73d7b29f7 16064->16066 16065->16068 16066->16010 16067 7ff73d7bdb60 47 API calls 16067->16068 16068->16067 16068->16069 16069->16064 16203 7ff73d7af314 16070->16203 16074 7ff73d7b3847 16073->16074 16220 7ff73d7bccc0 16074->16220 16080 7ff73d7b2f9a 16079->16080 16128 7ff73d7af180 16080->16128 16085 7ff73d7b3830 45 API calls 16087 7ff73d7b30d7 16085->16087 16086 7ff73d7b3830 45 API calls 16088 7ff73d7b3160 16086->16088 16087->16086 16087->16087 16087->16088 16088->16038 16090 7ff73d7b344c 16089->16090 16091 7ff73d7b34b4 16089->16091 16090->16091 16092 7ff73d7bdb60 47 API calls 16090->16092 16091->16038 16092->16091 16096 7ff73d7b35ed 16093->16096 16094 7ff73d7b9e44 _invalid_parameter_noinfo 37 API calls 16095 7ff73d7b361e 16094->16095 16095->16038 16096->16094 16096->16095 16098 7ff73d7b0183 16097->16098 16099 7ff73d7b01b2 16098->16099 16101 7ff73d7b026f 16098->16101 16100 7ff73d7af180 12 API calls 16099->16100 16103 7ff73d7b01ef 16099->16103 16100->16103 16102 7ff73d7b9e44 _invalid_parameter_noinfo 37 API calls 16101->16102 16102->16103 16103->16038 16105 7ff73d7afd73 16104->16105 16106 7ff73d7afda2 16105->16106 16108 7ff73d7afe5f 16105->16108 16107 7ff73d7af180 12 API calls 16106->16107 16110 7ff73d7afddf 16106->16110 16107->16110 16109 7ff73d7b9e44 _invalid_parameter_noinfo 37 API calls 16108->16109 16109->16110 16110->16038 16112 7ff73d7b0593 16111->16112 16113 7ff73d7b05c2 16112->16113 16115 7ff73d7b067f 16112->16115 16114 7ff73d7af180 12 API calls 16113->16114 16117 7ff73d7b05ff 16113->16117 16114->16117 16116 7ff73d7b9e44 _invalid_parameter_noinfo 37 API calls 16115->16116 16116->16117 16117->16038 16119 7ff73d7bdb88 16118->16119 16120 7ff73d7bdbcd 16119->16120 16122 7ff73d7b3830 45 API calls 16119->16122 16124 7ff73d7bdb8d memcpy_s 16119->16124 16127 7ff73d7bdbb6 memcpy_s 16119->16127 16120->16124 16120->16127 16200 7ff73d7bf138 16120->16200 16121 7ff73d7b9e44 _invalid_parameter_noinfo 37 API calls 16121->16124 16122->16120 16124->16038 16127->16121 16127->16124 16129 7ff73d7af1b7 16128->16129 16130 7ff73d7af1a6 16128->16130 16129->16130 16131 7ff73d7bcc2c _fread_nolock 12 API calls 16129->16131 16136 7ff73d7bd878 16130->16136 16132 7ff73d7af1e4 16131->16132 16133 7ff73d7af1f8 16132->16133 16134 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16132->16134 16135 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16133->16135 16134->16133 16135->16130 16137 7ff73d7bd895 16136->16137 16138 7ff73d7bd8c8 16136->16138 16139 7ff73d7b9e44 _invalid_parameter_noinfo 37 API calls 16137->16139 16138->16137 16140 7ff73d7bd8fa 16138->16140 16155 7ff73d7b30b5 16139->16155 16141 7ff73d7bd942 16140->16141 16146 7ff73d7bda0d 16140->16146 16141->16155 16158 7ff73d7b930c 16141->16158 16142 7ff73d7bdaff 16191 7ff73d7bcd64 16142->16191 16144 7ff73d7bdac5 16184 7ff73d7bd0fc 16144->16184 16146->16142 16146->16144 16147 7ff73d7bda94 16146->16147 16149 7ff73d7bda57 16146->16149 16150 7ff73d7bda4d 16146->16150 16177 7ff73d7bd3dc 16147->16177 16167 7ff73d7bd60c 16149->16167 16150->16144 16152 7ff73d7bda52 16150->16152 16152->16147 16152->16149 16155->16085 16155->16087 16156 7ff73d7b9f30 _wfindfirst32i64 17 API calls 16157 7ff73d7bdb5c 16156->16157 16159 7ff73d7b9319 16158->16159 16161 7ff73d7b9323 16158->16161 16159->16161 16165 7ff73d7b933e 16159->16165 16160 7ff73d7b6088 memcpy_s 11 API calls 16162 7ff73d7b932a 16160->16162 16161->16160 16163 7ff73d7b9f10 _invalid_parameter_noinfo 37 API calls 16162->16163 16164 7ff73d7b9336 16163->16164 16164->16155 16164->16156 16165->16164 16166 7ff73d7b6088 memcpy_s 11 API calls 16165->16166 16166->16162 16168 7ff73d7c324c 38 API calls 16167->16168 16169 7ff73d7bd659 16168->16169 16170 7ff73d7c2c94 37 API calls 16169->16170 16173 7ff73d7bd6b4 16170->16173 16171 7ff73d7bd6b8 16171->16155 16172 7ff73d7bd709 16174 7ff73d7bd1f8 45 API calls 16172->16174 16173->16171 16173->16172 16175 7ff73d7bd6d4 16173->16175 16174->16171 16176 7ff73d7bd4b4 45 API calls 16175->16176 16176->16171 16178 7ff73d7c324c 38 API calls 16177->16178 16179 7ff73d7bd426 16178->16179 16180 7ff73d7c2c94 37 API calls 16179->16180 16181 7ff73d7bd476 16180->16181 16182 7ff73d7bd47a 16181->16182 16183 7ff73d7bd4b4 45 API calls 16181->16183 16182->16155 16183->16182 16185 7ff73d7c324c 38 API calls 16184->16185 16186 7ff73d7bd147 16185->16186 16187 7ff73d7c2c94 37 API calls 16186->16187 16188 7ff73d7bd19f 16187->16188 16189 7ff73d7bd1a3 16188->16189 16190 7ff73d7bd1f8 45 API calls 16188->16190 16189->16155 16190->16189 16192 7ff73d7bcda9 16191->16192 16193 7ff73d7bcddc 16191->16193 16194 7ff73d7b9e44 _invalid_parameter_noinfo 37 API calls 16192->16194 16195 7ff73d7bce75 16193->16195 16196 7ff73d7bcdf4 16193->16196 16199 7ff73d7bcdd5 memcpy_s 16194->16199 16198 7ff73d7b3830 45 API calls 16195->16198 16195->16199 16197 7ff73d7bd0fc 46 API calls 16196->16197 16197->16199 16198->16199 16199->16155 16202 7ff73d7bf15c WideCharToMultiByte 16200->16202 16204 7ff73d7af341 16203->16204 16205 7ff73d7af353 16203->16205 16206 7ff73d7b6088 memcpy_s 11 API calls 16204->16206 16207 7ff73d7af360 16205->16207 16211 7ff73d7af39d 16205->16211 16208 7ff73d7af346 16206->16208 16209 7ff73d7b9e44 _invalid_parameter_noinfo 37 API calls 16207->16209 16210 7ff73d7b9f10 _invalid_parameter_noinfo 37 API calls 16208->16210 16215 7ff73d7af351 16209->16215 16210->16215 16212 7ff73d7af446 16211->16212 16213 7ff73d7b6088 memcpy_s 11 API calls 16211->16213 16214 7ff73d7b6088 memcpy_s 11 API calls 16212->16214 16212->16215 16216 7ff73d7af43b 16213->16216 16217 7ff73d7af4f0 16214->16217 16215->16010 16218 7ff73d7b9f10 _invalid_parameter_noinfo 37 API calls 16216->16218 16219 7ff73d7b9f10 _invalid_parameter_noinfo 37 API calls 16217->16219 16218->16212 16219->16215 16221 7ff73d7b386f 16220->16221 16222 7ff73d7bccd9 16220->16222 16224 7ff73d7bcd2c 16221->16224 16222->16221 16228 7ff73d7c24a4 16222->16228 16225 7ff73d7bcd45 16224->16225 16226 7ff73d7b387f 16224->16226 16225->16226 16241 7ff73d7c1810 16225->16241 16226->16010 16229 7ff73d7ba780 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 16228->16229 16230 7ff73d7c24b3 16229->16230 16231 7ff73d7c24fe 16230->16231 16240 7ff73d7bf808 EnterCriticalSection 16230->16240 16231->16221 16242 7ff73d7ba780 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 16241->16242 16243 7ff73d7c1819 16242->16243 16246 7ff73d7b3b86 16244->16246 16245 7ff73d7b3bbe 16247 7ff73d7b9e44 _invalid_parameter_noinfo 37 API calls 16245->16247 16246->16245 16248 7ff73d7b3bf1 16246->16248 16250 7ff73d7b3be7 16247->16250 16251 7ff73d7af140 16248->16251 16250->15999 16258 7ff73d7b438c EnterCriticalSection 16251->16258 16266 7ff73d7b438c EnterCriticalSection 16259->16266 16268 7ff73d7a1d00 86 API calls 16267->16268 16269 7ff73d7a1c37 16268->16269 16272 7ff73d7b44e0 16269->16272 16273 7ff73d7b450b 16272->16273 16276 7ff73d7b43a4 16273->16276 16289 7ff73d7b6d50 EnterCriticalSection 16276->16289 16291 7ff73d7a2cdc GetModuleFileNameW 16290->16291 16291->15638 16291->15639 16293 7ff73d7a6f52 WideCharToMultiByte 16292->16293 16294 7ff73d7a6ee4 WideCharToMultiByte 16292->16294 16296 7ff73d7a6f7f 16293->16296 16300 7ff73d7a2d35 16293->16300 16295 7ff73d7a6f0e 16294->16295 16299 7ff73d7a6f25 16294->16299 16297 7ff73d7a1cb0 86 API calls 16295->16297 16298 7ff73d7a1cb0 86 API calls 16296->16298 16297->16300 16298->16300 16299->16293 16301 7ff73d7a6f3b 16299->16301 16300->15642 16300->15644 16302 7ff73d7a1cb0 86 API calls 16301->16302 16302->16300 16304 7ff73d7b9283 16303->16304 16307 7ff73d7a5b6e 16303->16307 16305 7ff73d7b930c __std_exception_copy 37 API calls 16304->16305 16304->16307 16306 7ff73d7b92b0 16305->16306 16306->16307 16308 7ff73d7b9f30 _wfindfirst32i64 17 API calls 16306->16308 16307->15663 16309 7ff73d7b92e0 16308->16309 16311 7ff73d7a17e4 16310->16311 16312 7ff73d7a17d4 16310->16312 16314 7ff73d7a6360 83 API calls 16311->16314 16342 7ff73d7a1842 16311->16342 16313 7ff73d7a2de0 120 API calls 16312->16313 16313->16311 16315 7ff73d7a1815 16314->16315 16315->16342 16344 7ff73d7aec94 16315->16344 16317 7ff73d7aa100 _wfindfirst32i64 8 API calls 16319 7ff73d7a19c0 16317->16319 16318 7ff73d7a182b 16320 7ff73d7a182f 16318->16320 16321 7ff73d7a184c 16318->16321 16319->15678 16319->15679 16323 7ff73d7a1c10 86 API calls 16320->16323 16348 7ff73d7ae95c 16321->16348 16323->16342 16325 7ff73d7a1867 16327 7ff73d7a1c10 86 API calls 16325->16327 16326 7ff73d7aec94 73 API calls 16328 7ff73d7a18d1 16326->16328 16327->16342 16329 7ff73d7a18e3 16328->16329 16330 7ff73d7a18fe 16328->16330 16331 7ff73d7a1c10 86 API calls 16329->16331 16332 7ff73d7ae95c _fread_nolock 53 API calls 16330->16332 16331->16342 16333 7ff73d7a1913 16332->16333 16333->16325 16334 7ff73d7a1925 16333->16334 16351 7ff73d7ae6d0 16334->16351 16337 7ff73d7a193d 16338 7ff73d7a1c50 86 API calls 16337->16338 16338->16342 16339 7ff73d7a1993 16340 7ff73d7ae60c 74 API calls 16339->16340 16339->16342 16340->16342 16341 7ff73d7a1950 16341->16339 16343 7ff73d7a1c50 86 API calls 16341->16343 16342->16317 16343->16339 16345 7ff73d7aecc4 16344->16345 16357 7ff73d7aea24 16345->16357 16347 7ff73d7aecdd 16347->16318 16369 7ff73d7ae97c 16348->16369 16352 7ff73d7ae6d9 16351->16352 16353 7ff73d7a1939 16351->16353 16354 7ff73d7b6088 memcpy_s 11 API calls 16352->16354 16353->16337 16353->16341 16355 7ff73d7ae6de 16354->16355 16356 7ff73d7b9f10 _invalid_parameter_noinfo 37 API calls 16355->16356 16356->16353 16358 7ff73d7aea8e 16357->16358 16359 7ff73d7aea4e 16357->16359 16358->16359 16360 7ff73d7aea9a 16358->16360 16361 7ff73d7b9e44 _invalid_parameter_noinfo 37 API calls 16359->16361 16368 7ff73d7b438c EnterCriticalSection 16360->16368 16362 7ff73d7aea75 16361->16362 16362->16347 16370 7ff73d7ae9a6 16369->16370 16371 7ff73d7a1861 16369->16371 16370->16371 16372 7ff73d7ae9f2 16370->16372 16373 7ff73d7ae9b5 memcpy_s 16370->16373 16371->16325 16371->16326 16382 7ff73d7b438c EnterCriticalSection 16372->16382 16376 7ff73d7b6088 memcpy_s 11 API calls 16373->16376 16378 7ff73d7ae9ca 16376->16378 16380 7ff73d7b9f10 _invalid_parameter_noinfo 37 API calls 16378->16380 16380->16371 16476 7ff73d7a5880 16383->16476 16385 7ff73d7a1454 16386 7ff73d7a1459 16385->16386 16485 7ff73d7a5ba0 16385->16485 16386->15707 16389 7ff73d7a14a7 16392 7ff73d7a14e0 16389->16392 16395 7ff73d7a2de0 120 API calls 16389->16395 16390 7ff73d7a1487 16391 7ff73d7a1c10 86 API calls 16390->16391 16394 7ff73d7a149d 16391->16394 16393 7ff73d7aec94 73 API calls 16392->16393 16396 7ff73d7a14f2 16393->16396 16394->15707 16397 7ff73d7a14bf 16395->16397 16398 7ff73d7a1516 16396->16398 16399 7ff73d7a14f6 16396->16399 16397->16392 16400 7ff73d7a14c7 16397->16400 16402 7ff73d7a1534 16398->16402 16403 7ff73d7a151c 16398->16403 16401 7ff73d7a1c10 86 API calls 16399->16401 16404 7ff73d7a1c50 86 API calls 16400->16404 16416 7ff73d7a14d6 __std_exception_destroy 16401->16416 16407 7ff73d7a1556 16402->16407 16408 7ff73d7a1575 16402->16408 16510 7ff73d7a1050 16403->16510 16404->16416 16406 7ff73d7a1624 16410 7ff73d7ae60c 74 API calls 16406->16410 16411 7ff73d7a1c10 86 API calls 16407->16411 16412 7ff73d7ae95c _fread_nolock 53 API calls 16408->16412 16414 7ff73d7a15d5 16408->16414 16408->16416 16528 7ff73d7af09c 16408->16528 16409 7ff73d7ae60c 74 API calls 16409->16406 16410->16394 16411->16416 16412->16408 16415 7ff73d7a1c10 86 API calls 16414->16415 16415->16416 16416->16406 16416->16409 16418 7ff73d7a1dd6 16417->16418 16419 7ff73d7a1b30 49 API calls 16418->16419 16421 7ff73d7a1e0b 16419->16421 16420 7ff73d7a2211 16421->16420 16422 7ff73d7a2c50 49 API calls 16421->16422 16423 7ff73d7a1e7f 16422->16423 17084 7ff73d7a2230 16423->17084 16426 7ff73d7a1ec1 16428 7ff73d7a5880 127 API calls 16426->16428 16427 7ff73d7a1efa 16429 7ff73d7a2230 75 API calls 16427->16429 16430 7ff73d7a1ec9 16428->16430 16431 7ff73d7a1f4c 16429->16431 16434 7ff73d7a1eea 16430->16434 17092 7ff73d7a5760 16430->17092 16432 7ff73d7a1f50 16431->16432 16433 7ff73d7a1fb6 16431->16433 16435 7ff73d7a5880 127 API calls 16432->16435 16438 7ff73d7a2230 75 API calls 16433->16438 16436 7ff73d7a1c50 86 API calls 16434->16436 16440 7ff73d7a1ef3 16434->16440 16439 7ff73d7a1f58 16435->16439 16436->16440 16441 7ff73d7a1fe2 16438->16441 16439->16434 16444 7ff73d7a5760 138 API calls 16439->16444 16446 7ff73d7aa100 _wfindfirst32i64 8 API calls 16440->16446 16442 7ff73d7a2042 16441->16442 16443 7ff73d7a2230 75 API calls 16441->16443 16442->16420 16445 7ff73d7a5880 127 API calls 16442->16445 16447 7ff73d7a2012 16443->16447 16448 7ff73d7a1f75 16444->16448 16453 7ff73d7a2052 16445->16453 16449 7ff73d7a1fab 16446->16449 16447->16442 16451 7ff73d7a2230 75 API calls 16447->16451 16448->16434 16450 7ff73d7a21f6 16448->16450 16449->15707 16455 7ff73d7a1c50 86 API calls 16450->16455 16451->16442 16452 7ff73d7a1af0 86 API calls 16454 7ff73d7a20af 16452->16454 16453->16420 16453->16452 16458 7ff73d7a216f 16453->16458 16454->16420 16456 7ff73d7a1b30 49 API calls 16454->16456 16471 7ff73d7a216a 16455->16471 16459 7ff73d7a20d7 16456->16459 16457 7ff73d7a1ab0 74 API calls 16457->16420 16463 7ff73d7a21db 16458->16463 16466 7ff73d7a1780 86 API calls 16458->16466 16459->16450 16460 7ff73d7a1b30 49 API calls 16459->16460 16462 7ff73d7a2104 16460->16462 16461 7ff73d7a1440 158 API calls 16461->16463 16462->16450 16464 7ff73d7a1b30 49 API calls 16462->16464 16463->16450 16463->16461 16465 7ff73d7a2131 16464->16465 16465->16450 16467 7ff73d7a17b0 121 API calls 16465->16467 16466->16458 16471->16457 16473 7ff73d7a17a1 16472->16473 16474 7ff73d7a1795 16472->16474 16473->15707 16475 7ff73d7a1c50 86 API calls 16474->16475 16475->16473 16477 7ff73d7a58c8 16476->16477 16478 7ff73d7a5892 16476->16478 16477->16385 16532 7ff73d7a16d0 16478->16532 16483 7ff73d7a1c50 86 API calls 16484 7ff73d7a58bd 16483->16484 16484->16385 16486 7ff73d7a5bb0 16485->16486 16487 7ff73d7a1b30 49 API calls 16486->16487 16488 7ff73d7a5be1 16487->16488 16489 7ff73d7a5dab 16488->16489 16490 7ff73d7a1b30 49 API calls 16488->16490 16491 7ff73d7aa100 _wfindfirst32i64 8 API calls 16489->16491 16493 7ff73d7a5c08 16490->16493 16492 7ff73d7a147f 16491->16492 16492->16389 16492->16390 16493->16489 17047 7ff73d7b5158 16493->17047 16495 7ff73d7a5d19 16496 7ff73d7a6db0 88 API calls 16495->16496 16498 7ff73d7a5d31 16496->16498 16497 7ff73d7a5dda 16499 7ff73d7a2de0 120 API calls 16497->16499 16498->16497 16502 7ff73d7a5af0 92 API calls 16498->16502 16506 7ff73d7a5d62 __std_exception_destroy 16498->16506 16499->16489 16500 7ff73d7a5d9f 16503 7ff73d7a1c50 86 API calls 16500->16503 16501 7ff73d7a5dce 16505 7ff73d7a1c50 86 API calls 16501->16505 16502->16506 16503->16489 16504 7ff73d7a5c3d 16504->16489 16504->16495 16507 7ff73d7b5158 49 API calls 16504->16507 16508 7ff73d7a6db0 88 API calls 16504->16508 16509 7ff73d7a6a60 58 API calls 16504->16509 16505->16497 16506->16500 16506->16501 16507->16504 16508->16504 16509->16504 16511 7ff73d7a10a6 16510->16511 16512 7ff73d7a10d3 16511->16512 16513 7ff73d7a10ad 16511->16513 16516 7ff73d7a1109 16512->16516 16517 7ff73d7a10ed 16512->16517 16514 7ff73d7a1c50 86 API calls 16513->16514 16515 7ff73d7a10c0 16514->16515 16515->16416 16519 7ff73d7a111b 16516->16519 16526 7ff73d7a1137 memcpy_s 16516->16526 16518 7ff73d7a1c10 86 API calls 16517->16518 16522 7ff73d7a1104 __std_exception_destroy 16518->16522 16520 7ff73d7a1c10 86 API calls 16519->16520 16520->16522 16521 7ff73d7ae95c _fread_nolock 53 API calls 16521->16526 16522->16416 16523 7ff73d7a11fe 16524 7ff73d7a1c50 86 API calls 16523->16524 16524->16522 16525 7ff73d7af09c 76 API calls 16525->16526 16526->16521 16526->16522 16526->16523 16526->16525 16527 7ff73d7ae6d0 37 API calls 16526->16527 16527->16526 16529 7ff73d7af0cc 16528->16529 17069 7ff73d7aedec 16529->17069 16531 7ff73d7af0ea 16531->16408 16535 7ff73d7a16f5 16532->16535 16533 7ff73d7a1738 16536 7ff73d7a58e0 16533->16536 16534 7ff73d7a1c50 86 API calls 16534->16533 16535->16533 16535->16534 16537 7ff73d7a58f8 16536->16537 16538 7ff73d7a5918 16537->16538 16539 7ff73d7a596b 16537->16539 16541 7ff73d7a5af0 92 API calls 16538->16541 16540 7ff73d7a5970 GetTempPathW GetCurrentProcessId 16539->16540 16575 7ff73d7a6610 16540->16575 16543 7ff73d7a5924 16541->16543 16599 7ff73d7a55e0 16543->16599 16548 7ff73d7a594a __std_exception_destroy 16548->16540 16554 7ff73d7a5958 16548->16554 16549 7ff73d7aa100 _wfindfirst32i64 8 API calls 16551 7ff73d7a58ad 16549->16551 16551->16477 16551->16483 16552 7ff73d7a599e __std_exception_destroy 16553 7ff73d7a5a46 16552->16553 16557 7ff73d7a59d1 16552->16557 16579 7ff73d7b74d0 16552->16579 16582 7ff73d7a6a60 16552->16582 16555 7ff73d7a6ec0 88 API calls 16553->16555 16556 7ff73d7a1c50 86 API calls 16554->16556 16560 7ff73d7a5a57 __std_exception_destroy 16555->16560 16558 7ff73d7a5964 16556->16558 16559 7ff73d7a6db0 88 API calls 16557->16559 16566 7ff73d7a5a0a __std_exception_destroy 16557->16566 16558->16566 16561 7ff73d7a59e7 16559->16561 16562 7ff73d7a6db0 88 API calls 16560->16562 16560->16566 16563 7ff73d7a5a29 SetEnvironmentVariableW 16561->16563 16564 7ff73d7a59ec 16561->16564 16565 7ff73d7a5a75 16562->16565 16563->16566 16567 7ff73d7a6db0 88 API calls 16564->16567 16568 7ff73d7a5a7a 16565->16568 16569 7ff73d7a5aad SetEnvironmentVariableW 16565->16569 16566->16549 16570 7ff73d7a59fc 16567->16570 16571 7ff73d7a6db0 88 API calls 16568->16571 16569->16566 16572 7ff73d7b6818 38 API calls 16570->16572 16573 7ff73d7a5a8a 16571->16573 16572->16566 16574 7ff73d7b6818 38 API calls 16573->16574 16574->16566 16576 7ff73d7a6635 16575->16576 16633 7ff73d7b3ed4 16576->16633 16805 7ff73d7b70fc 16579->16805 16583 7ff73d7aa130 16582->16583 16584 7ff73d7a6a70 GetCurrentProcess OpenProcessToken 16583->16584 16585 7ff73d7a6b31 __std_exception_destroy 16584->16585 16586 7ff73d7a6abb GetTokenInformation 16584->16586 16589 7ff73d7a6b44 CloseHandle 16585->16589 16590 7ff73d7a6b4a 16585->16590 16587 7ff73d7a6ae8 16586->16587 16588 7ff73d7a6add GetLastError 16586->16588 16587->16585 16592 7ff73d7a6afe GetTokenInformation 16587->16592 16588->16585 16588->16587 16589->16590 16936 7ff73d7a6760 16590->16936 16592->16585 16594 7ff73d7a6b24 ConvertSidToStringSidW 16592->16594 16594->16585 16595 7ff73d7a6ba6 CreateDirectoryW 16596 7ff73d7a6bbe 16595->16596 16597 7ff73d7aa100 _wfindfirst32i64 8 API calls 16596->16597 16600 7ff73d7a55ec 16599->16600 16601 7ff73d7a6db0 88 API calls 16600->16601 16602 7ff73d7a560e 16601->16602 16603 7ff73d7a5616 16602->16603 16604 7ff73d7a5629 ExpandEnvironmentStringsW 16602->16604 16605 7ff73d7a1c50 86 API calls 16603->16605 16606 7ff73d7a564f __std_exception_destroy 16604->16606 16612 7ff73d7a5622 16605->16612 16607 7ff73d7a5653 16606->16607 16608 7ff73d7a5666 16606->16608 16610 7ff73d7a1c50 86 API calls 16607->16610 16613 7ff73d7a5680 16608->16613 16614 7ff73d7a5674 16608->16614 16609 7ff73d7aa100 _wfindfirst32i64 8 API calls 16611 7ff73d7a5748 16609->16611 16610->16612 16611->16566 16623 7ff73d7b6818 16611->16623 16612->16609 16947 7ff73d7b53b8 16613->16947 16940 7ff73d7b60a8 16614->16940 16617 7ff73d7a567e 16618 7ff73d7a569a 16617->16618 16621 7ff73d7a56ad memcpy_s 16617->16621 16619 7ff73d7a1c50 86 API calls 16618->16619 16619->16612 16620 7ff73d7a5722 CreateDirectoryW 16620->16612 16621->16620 16622 7ff73d7a56fc CreateDirectoryW 16621->16622 16622->16621 16624 7ff73d7b6825 16623->16624 16625 7ff73d7b6838 16623->16625 16626 7ff73d7b6088 memcpy_s 11 API calls 16624->16626 17039 7ff73d7b649c 16625->17039 16628 7ff73d7b682a 16626->16628 16631 7ff73d7b9f10 _invalid_parameter_noinfo 37 API calls 16628->16631 16630 7ff73d7b6836 16630->16548 16631->16630 16637 7ff73d7b3f2e 16633->16637 16634 7ff73d7b3f53 16635 7ff73d7b9e44 _invalid_parameter_noinfo 37 API calls 16634->16635 16639 7ff73d7b3f7d 16635->16639 16636 7ff73d7b3f8f 16651 7ff73d7b1a44 16636->16651 16637->16634 16637->16636 16641 7ff73d7aa100 _wfindfirst32i64 8 API calls 16639->16641 16640 7ff73d7b403c 16646 7ff73d7b4070 16640->16646 16650 7ff73d7b4045 16640->16650 16643 7ff73d7a6654 16641->16643 16642 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16642->16639 16643->16552 16645 7ff73d7b4096 16645->16646 16647 7ff73d7b40a0 16645->16647 16646->16642 16649 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16647->16649 16648 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 16648->16639 16649->16639 16650->16648 16652 7ff73d7b1a82 16651->16652 16653 7ff73d7b1a72 16651->16653 16654 7ff73d7b1a8b 16652->16654 16658 7ff73d7b1ab9 16652->16658 16655 7ff73d7b9e44 _invalid_parameter_noinfo 37 API calls 16653->16655 16656 7ff73d7b9e44 _invalid_parameter_noinfo 37 API calls 16654->16656 16657 7ff73d7b1ab1 16655->16657 16656->16657 16657->16640 16657->16645 16657->16646 16657->16650 16658->16653 16658->16657 16662 7ff73d7b2a18 16658->16662 16695 7ff73d7b202c 16658->16695 16732 7ff73d7b129c 16658->16732 16663 7ff73d7b2a5a 16662->16663 16664 7ff73d7b2acb 16662->16664 16667 7ff73d7b2a60 16663->16667 16668 7ff73d7b2af5 16663->16668 16665 7ff73d7b2ad0 16664->16665 16666 7ff73d7b2b24 16664->16666 16669 7ff73d7b2ad2 16665->16669 16670 7ff73d7b2b05 16665->16670 16674 7ff73d7b2b2e 16666->16674 16675 7ff73d7b2b3b 16666->16675 16680 7ff73d7b2b33 16666->16680 16671 7ff73d7b2a65 16667->16671 16672 7ff73d7b2a94 16667->16672 16751 7ff73d7b0354 16668->16751 16673 7ff73d7b2a74 16669->16673 16682 7ff73d7b2ae1 16669->16682 16758 7ff73d7aff44 16670->16758 16671->16675 16677 7ff73d7b2a6b 16671->16677 16672->16677 16672->16680 16693 7ff73d7b2b64 16673->16693 16735 7ff73d7b31cc 16673->16735 16674->16668 16674->16680 16765 7ff73d7b3720 16675->16765 16677->16673 16683 7ff73d7b2aa6 16677->16683 16690 7ff73d7b2a8f 16677->16690 16680->16693 16769 7ff73d7b0764 16680->16769 16682->16668 16685 7ff73d7b2ae6 16682->16685 16683->16693 16745 7ff73d7b3508 16683->16745 16688 7ff73d7b35cc 37 API calls 16685->16688 16685->16693 16687 7ff73d7aa100 _wfindfirst32i64 8 API calls 16689 7ff73d7b2e5e 16687->16689 16688->16690 16689->16658 16691 7ff73d7b3830 45 API calls 16690->16691 16690->16693 16694 7ff73d7b2d50 16690->16694 16691->16694 16693->16687 16694->16693 16776 7ff73d7bdd10 16694->16776 16696 7ff73d7b2050 16695->16696 16697 7ff73d7b203a 16695->16697 16698 7ff73d7b9e44 _invalid_parameter_noinfo 37 API calls 16696->16698 16699 7ff73d7b2090 16696->16699 16697->16699 16700 7ff73d7b2a5a 16697->16700 16701 7ff73d7b2acb 16697->16701 16698->16699 16699->16658 16704 7ff73d7b2a60 16700->16704 16705 7ff73d7b2af5 16700->16705 16702 7ff73d7b2ad0 16701->16702 16703 7ff73d7b2b24 16701->16703 16706 7ff73d7b2ad2 16702->16706 16707 7ff73d7b2b05 16702->16707 16711 7ff73d7b2b2e 16703->16711 16712 7ff73d7b2b3b 16703->16712 16717 7ff73d7b2b33 16703->16717 16708 7ff73d7b2a65 16704->16708 16709 7ff73d7b2a94 16704->16709 16713 7ff73d7b0354 38 API calls 16705->16713 16710 7ff73d7b2a74 16706->16710 16721 7ff73d7b2ae1 16706->16721 16715 7ff73d7aff44 38 API calls 16707->16715 16708->16712 16714 7ff73d7b2a6b 16708->16714 16709->16714 16709->16717 16716 7ff73d7b31cc 47 API calls 16710->16716 16731 7ff73d7b2b64 16710->16731 16711->16705 16711->16717 16718 7ff73d7b3720 45 API calls 16712->16718 16727 7ff73d7b2a8f 16713->16727 16714->16710 16719 7ff73d7b2aa6 16714->16719 16714->16727 16715->16727 16716->16727 16720 7ff73d7b0764 38 API calls 16717->16720 16717->16731 16718->16727 16722 7ff73d7b3508 46 API calls 16719->16722 16719->16731 16720->16727 16721->16705 16723 7ff73d7b2ae6 16721->16723 16722->16727 16725 7ff73d7b35cc 37 API calls 16723->16725 16723->16731 16724 7ff73d7aa100 _wfindfirst32i64 8 API calls 16726 7ff73d7b2e5e 16724->16726 16725->16727 16726->16658 16728 7ff73d7b3830 45 API calls 16727->16728 16730 7ff73d7b2d50 16727->16730 16727->16731 16728->16730 16729 7ff73d7bdd10 46 API calls 16729->16730 16730->16729 16730->16731 16731->16724 16788 7ff73d7af5c8 16732->16788 16736 7ff73d7b31f2 16735->16736 16737 7ff73d7af180 12 API calls 16736->16737 16738 7ff73d7b3242 16737->16738 16739 7ff73d7bd878 46 API calls 16738->16739 16740 7ff73d7b3315 16739->16740 16741 7ff73d7b3830 45 API calls 16740->16741 16742 7ff73d7b3337 16740->16742 16741->16742 16747 7ff73d7b353d 16745->16747 16746 7ff73d7b3582 16746->16690 16747->16746 16748 7ff73d7b355b 16747->16748 16749 7ff73d7b3830 45 API calls 16747->16749 16750 7ff73d7bdd10 46 API calls 16748->16750 16749->16748 16750->16746 16752 7ff73d7b0387 16751->16752 16753 7ff73d7b03b6 16752->16753 16755 7ff73d7b0473 16752->16755 16754 7ff73d7af228 12 API calls 16753->16754 16757 7ff73d7b03f3 16753->16757 16754->16757 16756 7ff73d7b9e44 _invalid_parameter_noinfo 37 API calls 16755->16756 16756->16757 16757->16690 16759 7ff73d7aff77 16758->16759 16760 7ff73d7affa6 16759->16760 16762 7ff73d7b0063 16759->16762 16761 7ff73d7af228 12 API calls 16760->16761 16764 7ff73d7affe3 16760->16764 16761->16764 16763 7ff73d7b9e44 _invalid_parameter_noinfo 37 API calls 16762->16763 16763->16764 16764->16690 16766 7ff73d7b3763 16765->16766 16767 7ff73d7b3767 __crtLCMapStringW 16766->16767 16768 7ff73d7b37bc 45 API calls 16766->16768 16767->16690 16768->16767 16770 7ff73d7b0797 16769->16770 16771 7ff73d7b07c6 16770->16771 16773 7ff73d7b0883 16770->16773 16772 7ff73d7af228 12 API calls 16771->16772 16775 7ff73d7b0803 16771->16775 16772->16775 16774 7ff73d7b9e44 _invalid_parameter_noinfo 37 API calls 16773->16774 16774->16775 16775->16690 16778 7ff73d7bdd41 16776->16778 16785 7ff73d7bdd4f 16776->16785 16777 7ff73d7bdd6f 16780 7ff73d7bdd80 16777->16780 16781 7ff73d7bdda7 16777->16781 16778->16777 16779 7ff73d7b3830 45 API calls 16778->16779 16778->16785 16779->16777 16782 7ff73d7bf5b8 8 API calls 16780->16782 16783 7ff73d7bde32 16781->16783 16784 7ff73d7bddd1 16781->16784 16781->16785 16782->16785 16786 7ff73d7be870 _fread_nolock MultiByteToWideChar 16783->16786 16784->16785 16787 7ff73d7be870 _fread_nolock MultiByteToWideChar 16784->16787 16785->16694 16786->16785 16787->16785 16789 7ff73d7af60f 16788->16789 16790 7ff73d7af5fd 16788->16790 16793 7ff73d7af61d 16789->16793 16797 7ff73d7af659 16789->16797 16791 7ff73d7b6088 memcpy_s 11 API calls 16790->16791 16792 7ff73d7af602 16791->16792 16794 7ff73d7b9f10 _invalid_parameter_noinfo 37 API calls 16792->16794 16795 7ff73d7b9e44 _invalid_parameter_noinfo 37 API calls 16793->16795 16802 7ff73d7af60d 16794->16802 16795->16802 16796 7ff73d7af9d5 16798 7ff73d7b6088 memcpy_s 11 API calls 16796->16798 16796->16802 16797->16796 16799 7ff73d7b6088 memcpy_s 11 API calls 16797->16799 16800 7ff73d7afc69 16798->16800 16801 7ff73d7af9ca 16799->16801 16803 7ff73d7b9f10 _invalid_parameter_noinfo 37 API calls 16800->16803 16804 7ff73d7b9f10 _invalid_parameter_noinfo 37 API calls 16801->16804 16802->16658 16803->16802 16804->16796 16846 7ff73d7c0718 16805->16846 16905 7ff73d7c0490 16846->16905 16926 7ff73d7bf808 EnterCriticalSection 16905->16926 16937 7ff73d7a6785 16936->16937 16938 7ff73d7b3ed4 48 API calls 16937->16938 16939 7ff73d7a67a8 LocalFree ConvertStringSecurityDescriptorToSecurityDescriptorW 16938->16939 16939->16595 16939->16596 16941 7ff73d7b60c6 16940->16941 16944 7ff73d7b60f9 16940->16944 16942 7ff73d7bf9a4 _wfindfirst32i64 37 API calls 16941->16942 16941->16944 16943 7ff73d7b60f5 16942->16943 16943->16944 16945 7ff73d7b9f30 _wfindfirst32i64 17 API calls 16943->16945 16944->16617 16946 7ff73d7b6129 16945->16946 16948 7ff73d7b5442 16947->16948 16949 7ff73d7b53d4 16947->16949 16984 7ff73d7bf110 16948->16984 16949->16948 16951 7ff73d7b53d9 16949->16951 16952 7ff73d7b53f1 16951->16952 16953 7ff73d7b540e 16951->16953 16959 7ff73d7b5188 GetFullPathNameW 16952->16959 16967 7ff73d7b51fc GetFullPathNameW 16953->16967 16958 7ff73d7b5406 __std_exception_destroy 16958->16617 16960 7ff73d7b51ae GetLastError 16959->16960 16964 7ff73d7b51c4 16959->16964 16961 7ff73d7b5ffc _fread_nolock 11 API calls 16960->16961 16963 7ff73d7b51bb 16961->16963 16962 7ff73d7b51c0 16962->16958 16966 7ff73d7b6088 memcpy_s 11 API calls 16963->16966 16964->16962 16965 7ff73d7b6088 memcpy_s 11 API calls 16964->16965 16965->16962 16966->16962 16968 7ff73d7b522f GetLastError 16967->16968 16971 7ff73d7b5245 __std_exception_destroy 16967->16971 16969 7ff73d7b5ffc _fread_nolock 11 API calls 16968->16969 16970 7ff73d7b523c 16969->16970 16973 7ff73d7b6088 memcpy_s 11 API calls 16970->16973 16972 7ff73d7b5241 16971->16972 16974 7ff73d7b529f GetFullPathNameW 16971->16974 16975 7ff73d7b52d4 16972->16975 16973->16972 16974->16968 16974->16972 16979 7ff73d7b5348 memcpy_s 16975->16979 16980 7ff73d7b52fd memcpy_s 16975->16980 16976 7ff73d7b5331 16977 7ff73d7b6088 memcpy_s 11 API calls 16976->16977 16978 7ff73d7b5336 16977->16978 16979->16958 16980->16976 16980->16979 16982 7ff73d7b536a 16980->16982 16982->16979 16983 7ff73d7b6088 memcpy_s 11 API calls 16982->16983 16983->16978 16987 7ff73d7bef20 16984->16987 16988 7ff73d7bef62 16987->16988 16989 7ff73d7bef4b 16987->16989 16991 7ff73d7bef66 16988->16991 16992 7ff73d7bef87 16988->16992 16990 7ff73d7b6088 memcpy_s 11 API calls 16989->16990 16994 7ff73d7bef50 16990->16994 17013 7ff73d7bf08c 16991->17013 17025 7ff73d7be588 16992->17025 16999 7ff73d7b9f10 _invalid_parameter_noinfo 37 API calls 16994->16999 17012 7ff73d7bef5b __std_exception_destroy 16999->17012 17003 7ff73d7aa100 _wfindfirst32i64 8 API calls 17006 7ff73d7bf081 17003->17006 17006->16958 17012->17003 17014 7ff73d7bf0d6 17013->17014 17015 7ff73d7bf0a6 17013->17015 17017 7ff73d7bf0e1 GetDriveTypeW 17014->17017 17018 7ff73d7bf0c1 17014->17018 17016 7ff73d7b6068 _fread_nolock 11 API calls 17015->17016 17019 7ff73d7bf0ab 17016->17019 17017->17018 17021 7ff73d7aa100 _wfindfirst32i64 8 API calls 17018->17021 17020 7ff73d7b6088 memcpy_s 11 API calls 17019->17020 17023 7ff73d7bef6b 17021->17023 17026 7ff73d7ab880 memcpy_s 17025->17026 17027 7ff73d7be5be GetCurrentDirectoryW 17026->17027 17028 7ff73d7be5d5 17027->17028 17029 7ff73d7be5fc 17027->17029 17031 7ff73d7aa100 _wfindfirst32i64 8 API calls 17028->17031 17030 7ff73d7bdeb8 memcpy_s 11 API calls 17029->17030 17032 7ff73d7be60b 17030->17032 17033 7ff73d7be669 17031->17033 17046 7ff73d7bf808 EnterCriticalSection 17039->17046 17048 7ff73d7ba780 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 17047->17048 17049 7ff73d7b516d 17048->17049 17050 7ff73d7bef17 17049->17050 17055 7ff73d7bee36 17049->17055 17056 7ff73d7aa294 17050->17056 17053 7ff73d7aa100 _wfindfirst32i64 8 API calls 17054 7ff73d7bef0f 17053->17054 17054->16504 17055->17053 17059 7ff73d7aa2a8 IsProcessorFeaturePresent 17056->17059 17060 7ff73d7aa2bf 17059->17060 17065 7ff73d7aa344 RtlCaptureContext RtlLookupFunctionEntry 17060->17065 17066 7ff73d7aa2d3 17065->17066 17067 7ff73d7aa374 RtlVirtualUnwind 17065->17067 17068 7ff73d7aa180 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 17066->17068 17067->17066 17070 7ff73d7aee0c 17069->17070 17071 7ff73d7aee39 17069->17071 17070->17071 17072 7ff73d7aee41 17070->17072 17073 7ff73d7aee16 17070->17073 17071->16531 17076 7ff73d7aed2c 17072->17076 17074 7ff73d7b9e44 _invalid_parameter_noinfo 37 API calls 17073->17074 17074->17071 17083 7ff73d7b438c EnterCriticalSection 17076->17083 17085 7ff73d7a2264 17084->17085 17086 7ff73d7b3c80 49 API calls 17085->17086 17087 7ff73d7a228a 17086->17087 17088 7ff73d7a229b 17087->17088 17116 7ff73d7b4e70 17087->17116 17090 7ff73d7aa100 _wfindfirst32i64 8 API calls 17088->17090 17091 7ff73d7a1ebd 17090->17091 17091->16426 17091->16427 17093 7ff73d7a576e 17092->17093 17094 7ff73d7a2de0 120 API calls 17093->17094 17095 7ff73d7a5795 17094->17095 17096 7ff73d7a5ba0 138 API calls 17095->17096 17097 7ff73d7a57a3 17096->17097 17098 7ff73d7a5853 17097->17098 17100 7ff73d7a57bd 17097->17100 17099 7ff73d7a584f 17098->17099 17101 7ff73d7ae60c 74 API calls 17098->17101 17103 7ff73d7aa100 _wfindfirst32i64 8 API calls 17099->17103 17300 7ff73d7ae6a4 17100->17300 17101->17099 17104 7ff73d7a5875 17103->17104 17104->16434 17105 7ff73d7a5830 17106 7ff73d7ae60c 74 API calls 17105->17106 17108 7ff73d7a5847 17106->17108 17107 7ff73d7ae95c _fread_nolock 53 API calls 17115 7ff73d7a57c2 17107->17115 17109 7ff73d7ae60c 74 API calls 17108->17109 17109->17099 17110 7ff73d7af09c 76 API calls 17110->17115 17111 7ff73d7a57f9 17306 7ff73d7b74ec 17111->17306 17112 7ff73d7ae6d0 37 API calls 17112->17115 17113 7ff73d7ae6a4 37 API calls 17113->17115 17115->17105 17115->17107 17115->17110 17115->17111 17115->17112 17115->17113 17117 7ff73d7b4e99 17116->17117 17118 7ff73d7b4e8d 17116->17118 17158 7ff73d7b4a84 17117->17158 17133 7ff73d7b46e8 17118->17133 17122 7ff73d7b4ed1 17169 7ff73d7b456c 17122->17169 17126 7ff73d7b4f41 17129 7ff73d7b46e8 69 API calls 17126->17129 17127 7ff73d7b4f2d 17128 7ff73d7b4e92 17127->17128 17130 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17127->17130 17128->17088 17131 7ff73d7b4f4d 17129->17131 17130->17128 17131->17128 17132 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17131->17132 17132->17128 17134 7ff73d7b4702 17133->17134 17135 7ff73d7b471f 17133->17135 17136 7ff73d7b6068 _fread_nolock 11 API calls 17134->17136 17135->17134 17137 7ff73d7b4732 CreateFileW 17135->17137 17138 7ff73d7b4707 17136->17138 17139 7ff73d7b4766 17137->17139 17140 7ff73d7b479c 17137->17140 17142 7ff73d7b6088 memcpy_s 11 API calls 17138->17142 17191 7ff73d7b483c GetFileType 17139->17191 17217 7ff73d7b4d60 17140->17217 17145 7ff73d7b470f 17142->17145 17149 7ff73d7b9f10 _invalid_parameter_noinfo 37 API calls 17145->17149 17147 7ff73d7b47d0 17238 7ff73d7b4b20 17147->17238 17148 7ff73d7b47a5 17152 7ff73d7b5ffc _fread_nolock 11 API calls 17148->17152 17153 7ff73d7b471a 17149->17153 17150 7ff73d7b4791 CloseHandle 17150->17153 17151 7ff73d7b477b CloseHandle 17151->17153 17157 7ff73d7b47af 17152->17157 17153->17128 17157->17153 17159 7ff73d7b4aa3 17158->17159 17160 7ff73d7b4aa8 17158->17160 17159->17122 17166 7ff73d7be144 17159->17166 17160->17159 17161 7ff73d7ba780 __FrameHandler3::FrameUnwindToEmptyState 45 API calls 17160->17161 17162 7ff73d7b4ac3 17161->17162 17279 7ff73d7bcc8c 17162->17279 17287 7ff73d7bdf30 17166->17287 17170 7ff73d7b4596 17169->17170 17171 7ff73d7b45ba 17169->17171 17172 7ff73d7b45a5 17170->17172 17175 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17170->17175 17173 7ff73d7b4614 17171->17173 17177 7ff73d7b45bf 17171->17177 17172->17126 17172->17127 17297 7ff73d7be870 17173->17297 17175->17172 17176 7ff73d7b45d4 17181 7ff73d7bcc2c _fread_nolock 12 API calls 17176->17181 17177->17172 17177->17176 17180 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 17177->17180 17180->17176 17181->17172 17192 7ff73d7b488a 17191->17192 17193 7ff73d7b4947 17191->17193 17194 7ff73d7b48b6 GetFileInformationByHandle 17192->17194 17198 7ff73d7b4c5c 21 API calls 17192->17198 17195 7ff73d7b4971 17193->17195 17196 7ff73d7b494f 17193->17196 17199 7ff73d7b4962 GetLastError 17194->17199 17200 7ff73d7b48df 17194->17200 17197 7ff73d7b4994 PeekNamedPipe 17195->17197 17206 7ff73d7b4932 17195->17206 17196->17199 17201 7ff73d7b4953 17196->17201 17197->17206 17203 7ff73d7b48a4 17198->17203 17202 7ff73d7b5ffc _fread_nolock 11 API calls 17199->17202 17204 7ff73d7b4b20 51 API calls 17200->17204 17205 7ff73d7b6088 memcpy_s 11 API calls 17201->17205 17202->17206 17203->17194 17203->17206 17208 7ff73d7b48ea 17204->17208 17205->17206 17207 7ff73d7aa100 _wfindfirst32i64 8 API calls 17206->17207 17210 7ff73d7b4774 17207->17210 17255 7ff73d7b49e4 17208->17255 17210->17150 17210->17151 17212 7ff73d7b49e4 10 API calls 17213 7ff73d7b4909 17212->17213 17214 7ff73d7b49e4 10 API calls 17213->17214 17218 7ff73d7b4d96 17217->17218 17219 7ff73d7b6088 memcpy_s 11 API calls 17218->17219 17237 7ff73d7b4e2e __std_exception_destroy 17218->17237 17221 7ff73d7b4da8 17219->17221 17220 7ff73d7aa100 _wfindfirst32i64 8 API calls 17222 7ff73d7b47a1 17220->17222 17223 7ff73d7b6088 memcpy_s 11 API calls 17221->17223 17222->17147 17222->17148 17224 7ff73d7b4db0 17223->17224 17225 7ff73d7b53b8 45 API calls 17224->17225 17226 7ff73d7b4dc5 17225->17226 17227 7ff73d7b4dd7 17226->17227 17228 7ff73d7b4dcd 17226->17228 17230 7ff73d7b6088 memcpy_s 11 API calls 17227->17230 17229 7ff73d7b6088 memcpy_s 11 API calls 17228->17229 17234 7ff73d7b4dd2 17229->17234 17231 7ff73d7b4ddc 17230->17231 17232 7ff73d7b6088 memcpy_s 11 API calls 17231->17232 17231->17237 17233 7ff73d7b4de6 17232->17233 17235 7ff73d7b53b8 45 API calls 17233->17235 17236 7ff73d7b4e20 GetDriveTypeW 17234->17236 17234->17237 17235->17234 17236->17237 17237->17220 17239 7ff73d7b4b48 17238->17239 17247 7ff73d7b47dd 17239->17247 17262 7ff73d7be6f4 17239->17262 17248 7ff73d7b4c5c 17247->17248 17249 7ff73d7b4c76 17248->17249 17250 7ff73d7b4cad 17249->17250 17251 7ff73d7b4c86 17249->17251 17252 7ff73d7be588 21 API calls 17250->17252 17253 7ff73d7b5ffc _fread_nolock 11 API calls 17251->17253 17254 7ff73d7b4c96 17251->17254 17252->17254 17253->17254 17254->17157 17256 7ff73d7b4a00 17255->17256 17257 7ff73d7b4a0d FileTimeToSystemTime 17255->17257 17256->17257 17260 7ff73d7b4a08 17256->17260 17258 7ff73d7b4a21 SystemTimeToTzSpecificLocalTime 17257->17258 17257->17260 17258->17260 17259 7ff73d7aa100 _wfindfirst32i64 8 API calls 17261 7ff73d7b48f9 17259->17261 17260->17259 17261->17212 17263 7ff73d7be701 17262->17263 17264 7ff73d7be725 17262->17264 17263->17264 17265 7ff73d7be706 17263->17265 17266 7ff73d7be75f 17264->17266 17269 7ff73d7be77e 17264->17269 17267 7ff73d7b6088 memcpy_s 11 API calls 17265->17267 17268 7ff73d7b6088 memcpy_s 11 API calls 17266->17268 17270 7ff73d7be70b 17267->17270 17271 7ff73d7be764 17268->17271 17272 7ff73d7b4a84 45 API calls 17269->17272 17273 7ff73d7b9f10 _invalid_parameter_noinfo 37 API calls 17270->17273 17274 7ff73d7b9f10 _invalid_parameter_noinfo 37 API calls 17271->17274 17277 7ff73d7be78b 17272->17277 17276 7ff73d7be76f 17274->17276 17277->17276 17278 7ff73d7c46c0 51 API calls 17277->17278 17278->17277 17280 7ff73d7bcca1 17279->17280 17281 7ff73d7b4ae6 17279->17281 17280->17281 17282 7ff73d7c24a4 45 API calls 17280->17282 17283 7ff73d7bccf8 17281->17283 17282->17281 17284 7ff73d7bcd20 17283->17284 17285 7ff73d7bcd0d 17283->17285 17284->17159 17285->17284 17286 7ff73d7c1810 45 API calls 17285->17286 17286->17284 17288 7ff73d7bdf8d 17287->17288 17295 7ff73d7bdf88 __vcrt_InitializeCriticalSectionEx 17287->17295 17288->17122 17289 7ff73d7bdfbd LoadLibraryW 17291 7ff73d7be092 17289->17291 17292 7ff73d7bdfe2 GetLastError 17289->17292 17290 7ff73d7be0b2 GetProcAddress 17290->17288 17294 7ff73d7be0c3 17290->17294 17291->17290 17293 7ff73d7be0a9 FreeLibrary 17291->17293 17292->17295 17293->17290 17294->17288 17295->17288 17295->17289 17295->17290 17296 7ff73d7be01c LoadLibraryExW 17295->17296 17296->17291 17296->17295 17299 7ff73d7be879 MultiByteToWideChar 17297->17299 17301 7ff73d7ae6ad 17300->17301 17303 7ff73d7ae6bd 17300->17303 17302 7ff73d7b6088 memcpy_s 11 API calls 17301->17302 17304 7ff73d7ae6b2 17302->17304 17303->17115 17305 7ff73d7b9f10 _invalid_parameter_noinfo 37 API calls 17304->17305 17305->17303 17307 7ff73d7b74f4 17306->17307 17308 7ff73d7b7531 17307->17308 17309 7ff73d7b7510 17307->17309 17327 7ff73d7b92ed 17326->17327 17331 7ff73d7a61da 17326->17331 17328 7ff73d7b6088 memcpy_s 11 API calls 17327->17328 17329 7ff73d7b92f2 17328->17329 17330 7ff73d7b9f10 _invalid_parameter_noinfo 37 API calls 17329->17330 17330->17331 17332 7ff73d7b705c 17331->17332 17333 7ff73d7b7065 17332->17333 17334 7ff73d7b707a 17332->17334 17335 7ff73d7b6068 _fread_nolock 11 API calls 17333->17335 17337 7ff73d7b6068 _fread_nolock 11 API calls 17334->17337 17341 7ff73d7b7072 17334->17341 17336 7ff73d7b706a 17335->17336 17338 7ff73d7b6088 memcpy_s 11 API calls 17336->17338 17339 7ff73d7b70b5 17337->17339 17338->17341 17340 7ff73d7b6088 memcpy_s 11 API calls 17339->17340 17342 7ff73d7b70bd 17340->17342 17341->15723 17343 7ff73d7b9f10 _invalid_parameter_noinfo 37 API calls 17342->17343 17343->17341 17383 7ff73d7b546c 17382->17383 17384 7ff73d7b5492 17383->17384 17386 7ff73d7b54c5 17383->17386 17385 7ff73d7b6088 memcpy_s 11 API calls 17384->17385 17387 7ff73d7b5497 17385->17387 17388 7ff73d7b54d8 17386->17388 17389 7ff73d7b54cb 17386->17389 17390 7ff73d7b9f10 _invalid_parameter_noinfo 37 API calls 17387->17390 17401 7ff73d7ba258 17388->17401 17391 7ff73d7b6088 memcpy_s 11 API calls 17389->17391 17393 7ff73d7a2e39 17390->17393 17391->17393 17393->15776 17414 7ff73d7bf808 EnterCriticalSection 17401->17414 17762 7ff73d7b7acc 17761->17762 17765 7ff73d7b75a8 17762->17765 17764 7ff73d7b7ae5 17764->15784 17766 7ff73d7b75f2 17765->17766 17767 7ff73d7b75c3 17765->17767 17775 7ff73d7b438c EnterCriticalSection 17766->17775 17768 7ff73d7b9e44 _invalid_parameter_noinfo 37 API calls 17767->17768 17770 7ff73d7b75e3 17768->17770 17770->17764 17777 7ff73d7ae431 17776->17777 17778 7ff73d7ae403 17776->17778 17785 7ff73d7ae423 17777->17785 17786 7ff73d7b438c EnterCriticalSection 17777->17786 17779 7ff73d7b9e44 _invalid_parameter_noinfo 37 API calls 17778->17779 17779->17785 17785->15790 17788 7ff73d7a12c6 17787->17788 17789 7ff73d7a12f8 17787->17789 17791 7ff73d7a2de0 120 API calls 17788->17791 17790 7ff73d7aec94 73 API calls 17789->17790 17792 7ff73d7a130a 17790->17792 17793 7ff73d7a12d6 17791->17793 17794 7ff73d7a132f 17792->17794 17795 7ff73d7a130e 17792->17795 17793->17789 17796 7ff73d7a12de 17793->17796 17801 7ff73d7a1364 17794->17801 17802 7ff73d7a1344 17794->17802 17797 7ff73d7a1c10 86 API calls 17795->17797 17798 7ff73d7a1c50 86 API calls 17796->17798 17799 7ff73d7a1325 17797->17799 17800 7ff73d7a12ee 17798->17800 17799->15800 17800->15800 17804 7ff73d7a137e 17801->17804 17809 7ff73d7a1395 17801->17809 17803 7ff73d7a1c10 86 API calls 17802->17803 17808 7ff73d7a135f __std_exception_destroy 17803->17808 17805 7ff73d7a1050 94 API calls 17804->17805 17805->17808 17806 7ff73d7ae95c _fread_nolock 53 API calls 17806->17809 17807 7ff73d7a1421 17807->15800 17808->17807 17810 7ff73d7ae60c 74 API calls 17808->17810 17809->17806 17809->17808 17811 7ff73d7a13de 17809->17811 17810->17807 17812 7ff73d7a1c10 86 API calls 17811->17812 17812->17808 17814 7ff73d7a1b30 49 API calls 17813->17814 17815 7ff73d7a2e90 17814->17815 17815->15802 17817 7ff73d7a1666 17816->17817 17818 7ff73d7a16aa 17816->17818 17817->17818 17819 7ff73d7a1c50 86 API calls 17817->17819 17818->15818 17820 7ff73d7a16be 17819->17820 17820->15818 17822 7ff73d7a6db0 88 API calls 17821->17822 17823 7ff73d7a6327 LoadLibraryExW 17822->17823 17824 7ff73d7a6344 __std_exception_destroy 17823->17824 17824->15827 17826 7ff73d7a3ad0 17825->17826 17827 7ff73d7a1b30 49 API calls 17826->17827 17828 7ff73d7a3b02 17827->17828 17829 7ff73d7a3b2b 17828->17829 17830 7ff73d7a3b0b 17828->17830 17832 7ff73d7a3b82 17829->17832 17834 7ff73d7a2e60 49 API calls 17829->17834 17831 7ff73d7a1c50 86 API calls 17830->17831 17852 7ff73d7a3b21 17831->17852 17833 7ff73d7a2e60 49 API calls 17832->17833 17835 7ff73d7a3b9b 17833->17835 17836 7ff73d7a3b4c 17834->17836 17837 7ff73d7a3bb9 17835->17837 17840 7ff73d7a1c50 86 API calls 17835->17840 17838 7ff73d7a3b6a 17836->17838 17842 7ff73d7a1c50 86 API calls 17836->17842 17841 7ff73d7a6310 89 API calls 17837->17841 17896 7ff73d7a2d70 17838->17896 17839 7ff73d7aa100 _wfindfirst32i64 8 API calls 17844 7ff73d7a22de 17839->17844 17840->17837 17845 7ff73d7a3bc6 17841->17845 17842->17838 17844->15906 17853 7ff73d7a3e40 17844->17853 17847 7ff73d7a3bcb 17845->17847 17848 7ff73d7a3bed 17845->17848 17849 7ff73d7a1cb0 86 API calls 17847->17849 17902 7ff73d7a2f20 GetProcAddress 17848->17902 17849->17852 17851 7ff73d7a6310 89 API calls 17851->17832 17852->17839 17854 7ff73d7a5af0 92 API calls 17853->17854 17856 7ff73d7a3e55 17854->17856 17855 7ff73d7a3e70 17857 7ff73d7a6db0 88 API calls 17855->17857 17856->17855 17858 7ff73d7a1c50 86 API calls 17856->17858 17859 7ff73d7a3eb4 17857->17859 17858->17855 17860 7ff73d7a3ed0 17859->17860 17861 7ff73d7a3eb9 17859->17861 17864 7ff73d7a6db0 88 API calls 17860->17864 17862 7ff73d7a1c50 86 API calls 17861->17862 17863 7ff73d7a3ec5 17862->17863 17863->15908 17865 7ff73d7a3f05 17864->17865 17868 7ff73d7a1b30 49 API calls 17865->17868 17879 7ff73d7a3f0a __std_exception_destroy 17865->17879 17866 7ff73d7a1c50 86 API calls 17867 7ff73d7a40b1 17866->17867 17867->15908 17869 7ff73d7a3f87 17868->17869 17870 7ff73d7a3fb3 17869->17870 17871 7ff73d7a3f8e 17869->17871 17872 7ff73d7a6db0 88 API calls 17870->17872 17873 7ff73d7a1c50 86 API calls 17871->17873 17875 7ff73d7a3fcc 17872->17875 17874 7ff73d7a3fa3 17873->17874 17874->15908 17875->17879 18009 7ff73d7a3c20 17875->18009 17879->17866 17880 7ff73d7a409a 17879->17880 17880->15908 17882 7ff73d7a3857 17881->17882 17882->17882 17883 7ff73d7a3880 17882->17883 17890 7ff73d7a3897 __std_exception_destroy 17882->17890 17884 7ff73d7a1c50 86 API calls 17883->17884 17885 7ff73d7a388c 17884->17885 17885->15910 17886 7ff73d7a397b 17886->15910 17887 7ff73d7a12b0 120 API calls 17887->17890 17888 7ff73d7a1780 86 API calls 17888->17890 17889 7ff73d7a1c50 86 API calls 17889->17890 17890->17886 17890->17887 17890->17888 17890->17889 17892 7ff73d7a3aa7 17891->17892 17894 7ff73d7a39bb 17891->17894 17892->15912 17893 7ff73d7a1780 86 API calls 17893->17894 17894->17892 17894->17893 17895 7ff73d7a1c50 86 API calls 17894->17895 17895->17894 17897 7ff73d7a2d7a 17896->17897 17898 7ff73d7a6db0 88 API calls 17897->17898 17899 7ff73d7a2da2 17898->17899 17900 7ff73d7aa100 _wfindfirst32i64 8 API calls 17899->17900 17901 7ff73d7a2dca 17900->17901 17901->17832 17901->17851 17903 7ff73d7a2f48 17902->17903 17904 7ff73d7a2f6b GetProcAddress 17902->17904 17906 7ff73d7a1cb0 86 API calls 17903->17906 17904->17903 17905 7ff73d7a2f90 GetProcAddress 17904->17905 17905->17903 17907 7ff73d7a2fb5 GetProcAddress 17905->17907 17908 7ff73d7a2f5b 17906->17908 17907->17903 17909 7ff73d7a2fdd GetProcAddress 17907->17909 17908->17852 17909->17903 17910 7ff73d7a3005 GetProcAddress 17909->17910 17910->17903 17911 7ff73d7a302d GetProcAddress 17910->17911 17912 7ff73d7a3055 GetProcAddress 17911->17912 17913 7ff73d7a3049 17911->17913 17914 7ff73d7a3071 17912->17914 17915 7ff73d7a307d GetProcAddress 17912->17915 17913->17912 17914->17915 17916 7ff73d7a3099 17915->17916 17917 7ff73d7a30d5 GetProcAddress 17916->17917 17918 7ff73d7a30ad GetProcAddress 17916->17918 17919 7ff73d7a30f1 17917->17919 17920 7ff73d7a30fd GetProcAddress 17917->17920 17918->17917 17921 7ff73d7a30c9 17918->17921 17919->17920 17922 7ff73d7a3125 GetProcAddress 17920->17922 17923 7ff73d7a3119 17920->17923 17921->17917 17924 7ff73d7a3141 17922->17924 17925 7ff73d7a314d GetProcAddress 17922->17925 17923->17922 17924->17925 17926 7ff73d7a3175 GetProcAddress 17925->17926 17927 7ff73d7a3169 17925->17927 17928 7ff73d7a3191 17926->17928 17929 7ff73d7a319d GetProcAddress 17926->17929 17927->17926 17928->17929 17930 7ff73d7a31c5 GetProcAddress 17929->17930 17931 7ff73d7a31b9 17929->17931 17932 7ff73d7a31e1 17930->17932 17933 7ff73d7a31ed GetProcAddress 17930->17933 17931->17930 17932->17933 17934 7ff73d7a3215 GetProcAddress 17933->17934 17935 7ff73d7a3209 17933->17935 17935->17934 18017 7ff73d7a3c3a 18009->18017 18010 7ff73d7a3df1 18011 7ff73d7aa100 _wfindfirst32i64 8 API calls 18010->18011 18013 7ff73d7a3e10 18011->18013 18012 7ff73d7a1780 86 API calls 18012->18017 18036 7ff73d7a6fb0 18013->18036 18014 7ff73d7a3d53 18014->18010 18016 7ff73d7b92e4 _fread_nolock 37 API calls 18014->18016 18018 7ff73d7a3d6a 18016->18018 18017->18010 18017->18012 18017->18014 18019 7ff73d7a3e29 18017->18019 18043 7ff73d7b5740 18017->18043 18047 7ff73d7b584c 18018->18047 18021 7ff73d7a1c50 86 API calls 18019->18021 18021->18010 18038 7ff73d7a6fcf 18036->18038 18044 7ff73d7b5770 18043->18044 18072 7ff73d7b5544 18044->18072 18052 7ff73d7b5875 18047->18052 18048 7ff73d7b58a2 18049 7ff73d7b58cf 18052->18048 18052->18049 18073 7ff73d7b5577 18072->18073 18074 7ff73d7b55b9 18073->18074 18075 7ff73d7b558c 18073->18075 18084 7ff73d7b557c 18073->18084 18079 7ff73d7b3830 45 API calls 18074->18079 18080 7ff73d7b55c7 18074->18080 18079->18080 18084->18084 18127 7ff73d7b8bb0 18130 7ff73d7b8b30 18127->18130 18137 7ff73d7bf808 EnterCriticalSection 18130->18137 18879 7ff73d7aa430 18880 7ff73d7aa440 18879->18880 18896 7ff73d7b580c 18880->18896 18882 7ff73d7aa44c 18902 7ff73d7aa748 18882->18902 18884 7ff73d7aaa2c 7 API calls 18887 7ff73d7aa4e5 18884->18887 18885 7ff73d7aa464 _RTC_Initialize 18894 7ff73d7aa4b9 18885->18894 18907 7ff73d7aa8f8 18885->18907 18888 7ff73d7aa479 18910 7ff73d7b7fd0 18888->18910 18894->18884 18895 7ff73d7aa4d5 18894->18895 18897 7ff73d7b581d 18896->18897 18898 7ff73d7b5825 18897->18898 18899 7ff73d7b6088 memcpy_s 11 API calls 18897->18899 18898->18882 18900 7ff73d7b5834 18899->18900 18901 7ff73d7b9f10 _invalid_parameter_noinfo 37 API calls 18900->18901 18901->18898 18903 7ff73d7aa759 18902->18903 18906 7ff73d7aa75e __scrt_release_startup_lock 18902->18906 18904 7ff73d7aaa2c 7 API calls 18903->18904 18903->18906 18905 7ff73d7aa7d2 18904->18905 18906->18885 18935 7ff73d7aa8bc 18907->18935 18909 7ff73d7aa901 18909->18888 18911 7ff73d7aa485 18910->18911 18912 7ff73d7b7ff0 18910->18912 18911->18894 18934 7ff73d7aa9cc InitializeSListHead 18911->18934 18913 7ff73d7b7ff8 18912->18913 18914 7ff73d7b800e GetModuleFileNameW 18912->18914 18915 7ff73d7b6088 memcpy_s 11 API calls 18913->18915 18918 7ff73d7b8039 18914->18918 18916 7ff73d7b7ffd 18915->18916 18917 7ff73d7b9f10 _invalid_parameter_noinfo 37 API calls 18916->18917 18917->18911 18950 7ff73d7b7f70 18918->18950 18921 7ff73d7b8081 18922 7ff73d7b6088 memcpy_s 11 API calls 18921->18922 18923 7ff73d7b8086 18922->18923 18924 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18923->18924 18924->18911 18925 7ff73d7b8099 18926 7ff73d7b80bb 18925->18926 18928 7ff73d7b8100 18925->18928 18929 7ff73d7b80e7 18925->18929 18927 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18926->18927 18927->18911 18931 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18928->18931 18930 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18929->18930 18932 7ff73d7b80f0 18930->18932 18931->18926 18933 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18932->18933 18933->18911 18936 7ff73d7aa8d6 18935->18936 18937 7ff73d7aa8cf 18935->18937 18939 7ff73d7b904c 18936->18939 18937->18909 18942 7ff73d7b8c88 18939->18942 18949 7ff73d7bf808 EnterCriticalSection 18942->18949 18951 7ff73d7b7fc0 18950->18951 18952 7ff73d7b7f88 18950->18952 18951->18921 18951->18925 18952->18951 18953 7ff73d7bdeb8 memcpy_s 11 API calls 18952->18953 18954 7ff73d7b7fb6 18953->18954 18955 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18954->18955 18955->18951 18956 7ff73d7b4330 18957 7ff73d7b433b 18956->18957 18965 7ff73d7be4c4 18957->18965 18978 7ff73d7bf808 EnterCriticalSection 18965->18978 15330 7ff73d7be95c 15331 7ff73d7beb4e 15330->15331 15333 7ff73d7be99e _isindst 15330->15333 15332 7ff73d7b6088 memcpy_s 11 API calls 15331->15332 15349 7ff73d7beb3e 15332->15349 15333->15331 15336 7ff73d7bea1e _isindst 15333->15336 15334 7ff73d7aa100 _wfindfirst32i64 8 API calls 15335 7ff73d7beb69 15334->15335 15351 7ff73d7c5434 15336->15351 15341 7ff73d7beb7a 15343 7ff73d7b9f30 _wfindfirst32i64 17 API calls 15341->15343 15345 7ff73d7beb8e 15343->15345 15348 7ff73d7bea7b 15348->15349 15375 7ff73d7c5478 15348->15375 15349->15334 15352 7ff73d7bea3c 15351->15352 15353 7ff73d7c5443 15351->15353 15357 7ff73d7c4838 15352->15357 15382 7ff73d7bf808 EnterCriticalSection 15353->15382 15358 7ff73d7c4841 15357->15358 15359 7ff73d7bea51 15357->15359 15360 7ff73d7b6088 memcpy_s 11 API calls 15358->15360 15359->15341 15363 7ff73d7c4868 15359->15363 15361 7ff73d7c4846 15360->15361 15362 7ff73d7b9f10 _invalid_parameter_noinfo 37 API calls 15361->15362 15362->15359 15364 7ff73d7c4871 15363->15364 15368 7ff73d7bea62 15363->15368 15365 7ff73d7b6088 memcpy_s 11 API calls 15364->15365 15366 7ff73d7c4876 15365->15366 15367 7ff73d7b9f10 _invalid_parameter_noinfo 37 API calls 15366->15367 15367->15368 15368->15341 15369 7ff73d7c4898 15368->15369 15370 7ff73d7c48a1 15369->15370 15371 7ff73d7bea73 15369->15371 15372 7ff73d7b6088 memcpy_s 11 API calls 15370->15372 15371->15341 15371->15348 15373 7ff73d7c48a6 15372->15373 15374 7ff73d7b9f10 _invalid_parameter_noinfo 37 API calls 15373->15374 15374->15371 15383 7ff73d7bf808 EnterCriticalSection 15375->15383 19077 7ff73d7c0870 19088 7ff73d7c67e4 19077->19088 19089 7ff73d7c67f1 19088->19089 19090 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19089->19090 19092 7ff73d7c680d 19089->19092 19090->19089 19091 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 19091->19092 19092->19091 19093 7ff73d7c0879 19092->19093 19094 7ff73d7bf808 EnterCriticalSection 19093->19094 15032 7ff73d7a96f0 15033 7ff73d7a971e 15032->15033 15034 7ff73d7a9705 15032->15034 15034->15033 15037 7ff73d7bcc2c 15034->15037 15038 7ff73d7bcc77 15037->15038 15042 7ff73d7bcc3b memcpy_s 15037->15042 15047 7ff73d7b6088 15038->15047 15039 7ff73d7bcc5e RtlAllocateHeap 15041 7ff73d7a977c 15039->15041 15039->15042 15042->15038 15042->15039 15044 7ff73d7c2730 15042->15044 15050 7ff73d7c2770 15044->15050 15056 7ff73d7ba8f8 GetLastError 15047->15056 15049 7ff73d7b6091 15049->15041 15055 7ff73d7bf808 EnterCriticalSection 15050->15055 15057 7ff73d7ba939 FlsSetValue 15056->15057 15058 7ff73d7ba91c 15056->15058 15059 7ff73d7ba94b 15057->15059 15071 7ff73d7ba929 SetLastError 15057->15071 15058->15057 15058->15071 15073 7ff73d7bdeb8 15059->15073 15063 7ff73d7ba978 FlsSetValue 15065 7ff73d7ba996 15063->15065 15066 7ff73d7ba984 FlsSetValue 15063->15066 15064 7ff73d7ba968 FlsSetValue 15067 7ff73d7ba971 15064->15067 15086 7ff73d7ba524 15065->15086 15066->15067 15080 7ff73d7b9f78 15067->15080 15071->15049 15074 7ff73d7bdec9 memcpy_s 15073->15074 15075 7ff73d7bdf1a 15074->15075 15076 7ff73d7bdefe RtlAllocateHeap 15074->15076 15079 7ff73d7c2730 memcpy_s 2 API calls 15074->15079 15077 7ff73d7b6088 memcpy_s 10 API calls 15075->15077 15076->15074 15078 7ff73d7ba95a 15076->15078 15077->15078 15078->15063 15078->15064 15079->15074 15081 7ff73d7b9f7d RtlRestoreThreadPreferredUILanguages 15080->15081 15085 7ff73d7b9fac 15080->15085 15082 7ff73d7b9f98 GetLastError 15081->15082 15081->15085 15083 7ff73d7b9fa5 Concurrency::details::SchedulerProxy::DeleteThis 15082->15083 15084 7ff73d7b6088 memcpy_s 9 API calls 15083->15084 15084->15085 15085->15071 15091 7ff73d7ba3fc 15086->15091 15103 7ff73d7bf808 EnterCriticalSection 15091->15103 18533 7ff73d7ba600 18534 7ff73d7ba61a 18533->18534 18535 7ff73d7ba605 18533->18535 18539 7ff73d7ba620 18535->18539 18540 7ff73d7ba662 18539->18540 18541 7ff73d7ba66a 18539->18541 18542 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18540->18542 18543 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18541->18543 18542->18541 18544 7ff73d7ba677 18543->18544 18545 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18544->18545 18546 7ff73d7ba684 18545->18546 18547 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18546->18547 18548 7ff73d7ba691 18547->18548 18549 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18548->18549 18550 7ff73d7ba69e 18549->18550 18551 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18550->18551 18552 7ff73d7ba6ab 18551->18552 18553 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18552->18553 18554 7ff73d7ba6b8 18553->18554 18555 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18554->18555 18556 7ff73d7ba6c5 18555->18556 18557 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18556->18557 18558 7ff73d7ba6d5 18557->18558 18559 7ff73d7b9f78 Concurrency::details::SchedulerProxy::DeleteThis 11 API calls 18558->18559 18560 7ff73d7ba6e5 18559->18560 18565 7ff73d7ba4c4 18560->18565 18579 7ff73d7bf808 EnterCriticalSection 18565->18579 18682 7ff73d7c96fd 18685 7ff73d7b4398 LeaveCriticalSection 18682->18685 15254 7ff73d7b6878 15255 7ff73d7b68df 15254->15255 15256 7ff73d7b68a6 15254->15256 15255->15256 15257 7ff73d7b68e4 FindFirstFileExW 15255->15257 15258 7ff73d7b6088 memcpy_s 11 API calls 15256->15258 15260 7ff73d7b6906 GetLastError 15257->15260 15261 7ff73d7b694d 15257->15261 15259 7ff73d7b68ab 15258->15259 15262 7ff73d7b9f10 _invalid_parameter_noinfo 37 API calls 15259->15262 15264 7ff73d7b6911 15260->15264 15265 7ff73d7b693d 15260->15265 15314 7ff73d7b6ae8 15261->15314 15266 7ff73d7b68b6 15262->15266 15264->15265 15270 7ff73d7b692d 15264->15270 15271 7ff73d7b691b 15264->15271 15267 7ff73d7b6088 memcpy_s 11 API calls 15265->15267 15273 7ff73d7aa100 _wfindfirst32i64 8 API calls 15266->15273 15267->15266 15269 7ff73d7b6ae8 _wfindfirst32i64 10 API calls 15274 7ff73d7b6973 15269->15274 15272 7ff73d7b6088 memcpy_s 11 API calls 15270->15272 15271->15265 15275 7ff73d7b6920 15271->15275 15272->15266 15276 7ff73d7b68ca 15273->15276 15277 7ff73d7b6ae8 _wfindfirst32i64 10 API calls 15274->15277 15278 7ff73d7b6088 memcpy_s 11 API calls 15275->15278 15279 7ff73d7b6981 15277->15279 15278->15266 15321 7ff73d7bf9a4 15279->15321 15282 7ff73d7b69ab 15283 7ff73d7b9f30 _wfindfirst32i64 17 API calls 15282->15283 15284 7ff73d7b69bf 15283->15284 15285 7ff73d7b69e9 15284->15285 15288 7ff73d7b6a28 FindNextFileW 15284->15288 15286 7ff73d7b6088 memcpy_s 11 API calls 15285->15286 15287 7ff73d7b69ee 15286->15287 15289 7ff73d7b9f10 _invalid_parameter_noinfo 37 API calls 15287->15289 15290 7ff73d7b6a37 GetLastError 15288->15290 15291 7ff73d7b6a78 15288->15291 15294 7ff73d7b69f9 15289->15294 15293 7ff73d7b6a6b 15290->15293 15297 7ff73d7b6a42 15290->15297 15292 7ff73d7b6ae8 _wfindfirst32i64 10 API calls 15291->15292 15296 7ff73d7b6a90 15292->15296 15295 7ff73d7b6088 memcpy_s 11 API calls 15293->15295 15300 7ff73d7aa100 _wfindfirst32i64 8 API calls 15294->15300 15295->15294 15301 7ff73d7b6ae8 _wfindfirst32i64 10 API calls 15296->15301 15297->15293 15298 7ff73d7b6a5e 15297->15298 15299 7ff73d7b6a4c 15297->15299 15303 7ff73d7b6088 memcpy_s 11 API calls 15298->15303 15299->15293 15302 7ff73d7b6a51 15299->15302 15304 7ff73d7b6a0c 15300->15304 15305 7ff73d7b6a9e 15301->15305 15306 7ff73d7b6088 memcpy_s 11 API calls 15302->15306 15303->15294 15307 7ff73d7b6ae8 _wfindfirst32i64 10 API calls 15305->15307 15306->15294 15308 7ff73d7b6aac 15307->15308 15309 7ff73d7bf9a4 _wfindfirst32i64 37 API calls 15308->15309 15310 7ff73d7b6aca 15309->15310 15310->15294 15311 7ff73d7b6ad2 15310->15311 15312 7ff73d7b9f30 _wfindfirst32i64 17 API calls 15311->15312 15313 7ff73d7b6ae6 15312->15313 15315 7ff73d7b6b00 15314->15315 15316 7ff73d7b6b06 FileTimeToSystemTime 15314->15316 15315->15316 15319 7ff73d7b6b2b 15315->15319 15317 7ff73d7b6b15 SystemTimeToTzSpecificLocalTime 15316->15317 15316->15319 15317->15319 15318 7ff73d7aa100 _wfindfirst32i64 8 API calls 15320 7ff73d7b6965 15318->15320 15319->15318 15320->15269 15322 7ff73d7bf9b1 15321->15322 15324 7ff73d7bf9bb 15321->15324 15322->15324 15328 7ff73d7bf9d7 15322->15328 15323 7ff73d7b6088 memcpy_s 11 API calls 15325 7ff73d7bf9c3 15323->15325 15324->15323 15326 7ff73d7b9f10 _invalid_parameter_noinfo 37 API calls 15325->15326 15327 7ff73d7b699f 15326->15327 15327->15266 15327->15282 15328->15327 15329 7ff73d7b6088 memcpy_s 11 API calls 15328->15329 15329->15325 19117 7ff73d7c9577 19118 7ff73d7c9587 19117->19118 19121 7ff73d7b4398 LeaveCriticalSection 19118->19121 19159 7ff73d7c9792 19160 7ff73d7c97a1 19159->19160 19162 7ff73d7c97ab 19159->19162 19163 7ff73d7bf868 LeaveCriticalSection 19160->19163

                                                                                                                                                  Executed Functions

                                                                                                                                                  Function 00007FF73D7C4EA0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334timeCOMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  • Executed
                                                                                                                                                  • Not Executed
                                                                                                                                                  control_flow_graph 135 7ff73d7c4ea0-7ff73d7c4edb call 7ff73d7c4828 call 7ff73d7c4830 call 7ff73d7c4898 142 7ff73d7c4ee1-7ff73d7c4eec call 7ff73d7c4838 135->142 143 7ff73d7c5105-7ff73d7c5151 call 7ff73d7b9f30 call 7ff73d7c4828 call 7ff73d7c4830 call 7ff73d7c4898 135->143 142->143 148 7ff73d7c4ef2-7ff73d7c4efc 142->148 169 7ff73d7c528f-7ff73d7c52fd call 7ff73d7b9f30 call 7ff73d7c0738 143->169 170 7ff73d7c5157-7ff73d7c5162 call 7ff73d7c4838 143->170 150 7ff73d7c4f1e-7ff73d7c4f22 148->150 151 7ff73d7c4efe-7ff73d7c4f01 148->151 155 7ff73d7c4f25-7ff73d7c4f2d 150->155 154 7ff73d7c4f04-7ff73d7c4f0f 151->154 158 7ff73d7c4f11-7ff73d7c4f18 154->158 159 7ff73d7c4f1a-7ff73d7c4f1c 154->159 155->155 156 7ff73d7c4f2f-7ff73d7c4f42 call 7ff73d7bcc2c 155->156 165 7ff73d7c4f44-7ff73d7c4f46 call 7ff73d7b9f78 156->165 166 7ff73d7c4f5a-7ff73d7c4f66 call 7ff73d7b9f78 156->166 158->154 158->159 159->150 162 7ff73d7c4f4b-7ff73d7c4f59 159->162 165->162 176 7ff73d7c4f6d-7ff73d7c4f75 166->176 189 7ff73d7c52ff-7ff73d7c5306 169->189 190 7ff73d7c530b-7ff73d7c530e 169->190 170->169 178 7ff73d7c5168-7ff73d7c5173 call 7ff73d7c4868 170->178 176->176 179 7ff73d7c4f77-7ff73d7c4f88 call 7ff73d7bf9a4 176->179 178->169 187 7ff73d7c5179-7ff73d7c519c call 7ff73d7b9f78 GetTimeZoneInformation 178->187 179->143 188 7ff73d7c4f8e-7ff73d7c4fe4 call 7ff73d7ab880 * 4 call 7ff73d7c4dbc 179->188 206 7ff73d7c51a2-7ff73d7c51c3 187->206 207 7ff73d7c5264-7ff73d7c528e call 7ff73d7c4820 call 7ff73d7c4810 call 7ff73d7c4818 187->207 247 7ff73d7c4fe6-7ff73d7c4fea 188->247 191 7ff73d7c539b-7ff73d7c539e 189->191 192 7ff73d7c5310 190->192 193 7ff73d7c5345-7ff73d7c5358 call 7ff73d7bcc2c 190->193 197 7ff73d7c53a4-7ff73d7c53ac call 7ff73d7c4ea0 191->197 198 7ff73d7c5313 191->198 192->198 211 7ff73d7c5363-7ff73d7c537e call 7ff73d7c0738 193->211 212 7ff73d7c535a 193->212 204 7ff73d7c5318-7ff73d7c5344 call 7ff73d7b9f78 call 7ff73d7aa100 197->204 198->204 205 7ff73d7c5313 call 7ff73d7c511c 198->205 205->204 214 7ff73d7c51c5-7ff73d7c51cb 206->214 215 7ff73d7c51ce-7ff73d7c51d5 206->215 235 7ff73d7c5380-7ff73d7c5383 211->235 236 7ff73d7c5385-7ff73d7c5397 call 7ff73d7b9f78 211->236 221 7ff73d7c535c-7ff73d7c5361 call 7ff73d7b9f78 212->221 214->215 216 7ff73d7c51e9 215->216 217 7ff73d7c51d7-7ff73d7c51df 215->217 226 7ff73d7c51eb-7ff73d7c525f call 7ff73d7ab880 * 4 call 7ff73d7c1cfc call 7ff73d7c53b4 * 2 216->226 217->216 223 7ff73d7c51e1-7ff73d7c51e7 217->223 221->192 223->226 226->207 235->221 236->191 249 7ff73d7c4ff0-7ff73d7c4ff4 247->249 250 7ff73d7c4fec 247->250 249->247 252 7ff73d7c4ff6-7ff73d7c501b call 7ff73d7c7ce4 249->252 250->249 258 7ff73d7c501e-7ff73d7c5022 252->258 260 7ff73d7c5031-7ff73d7c5035 258->260 261 7ff73d7c5024-7ff73d7c502f 258->261 260->258 261->260 263 7ff73d7c5037-7ff73d7c503b 261->263 266 7ff73d7c503d-7ff73d7c5065 call 7ff73d7c7ce4 263->266 267 7ff73d7c50bc-7ff73d7c50c0 263->267 275 7ff73d7c5083-7ff73d7c5087 266->275 276 7ff73d7c5067 266->276 268 7ff73d7c50c2-7ff73d7c50c4 267->268 269 7ff73d7c50c7-7ff73d7c50d4 267->269 268->269 271 7ff73d7c50ef-7ff73d7c50fe call 7ff73d7c4820 call 7ff73d7c4810 269->271 272 7ff73d7c50d6-7ff73d7c50ec call 7ff73d7c4dbc 269->272 271->143 272->271 275->267 281 7ff73d7c5089-7ff73d7c50a7 call 7ff73d7c7ce4 275->281 279 7ff73d7c506a-7ff73d7c5071 276->279 279->275 282 7ff73d7c5073-7ff73d7c5081 279->282 287 7ff73d7c50b3-7ff73d7c50ba 281->287 282->275 282->279 287->267 288 7ff73d7c50a9-7ff73d7c50ad 287->288 288->267 289 7ff73d7c50af 288->289 289->287
                                                                                                                                                  APIs
                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF73D7C4EE5
                                                                                                                                                    • Part of subcall function 00007FF73D7C4838: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73D7C484C
                                                                                                                                                    • Part of subcall function 00007FF73D7B9F78: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF73D7C1EC2,?,?,?,00007FF73D7C1EFF,?,?,00000000,00007FF73D7C23C5,?,?,00000000,00007FF73D7C22F7), ref: 00007FF73D7B9F8E
                                                                                                                                                    • Part of subcall function 00007FF73D7B9F78: GetLastError.KERNEL32(?,?,?,00007FF73D7C1EC2,?,?,?,00007FF73D7C1EFF,?,?,00000000,00007FF73D7C23C5,?,?,00000000,00007FF73D7C22F7), ref: 00007FF73D7B9F98
                                                                                                                                                    • Part of subcall function 00007FF73D7B9F30: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF73D7B9F0F,?,?,?,?,?,00007FF73D7B1A40), ref: 00007FF73D7B9F39
                                                                                                                                                    • Part of subcall function 00007FF73D7B9F30: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF73D7B9F0F,?,?,?,?,?,00007FF73D7B1A40), ref: 00007FF73D7B9F5E
                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF73D7C4ED4
                                                                                                                                                    • Part of subcall function 00007FF73D7C4898: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73D7C48AC
                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF73D7C514A
                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF73D7C515B
                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF73D7C516C
                                                                                                                                                  • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF73D7C53AC), ref: 00007FF73D7C5193
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureInformationLanguagesLastPreferredPresentProcessProcessorRestoreThreadTimeZone
                                                                                                                                                  • String ID: W. Europe Standard Time$W. Europe Summer Time
                                                                                                                                                  • API String ID: 1458651798-690618308
                                                                                                                                                  • Opcode ID: aa85b069b6fb92bd10a5b6d5be9144cf64bbc0ff06c8fbb0fdd7caf4b6a87e0b
                                                                                                                                                  • Instruction ID: 563544c33dd6ba9be267295d8291dd0775ece5b0d61c173268cefaf4e0df071b
                                                                                                                                                  • Opcode Fuzzy Hash: aa85b069b6fb92bd10a5b6d5be9144cf64bbc0ff06c8fbb0fdd7caf4b6a87e0b
                                                                                                                                                  • Instruction Fuzzy Hash: 06D1A222A1C25A6AE720BFB5D8501B9A6A1FF4C7A4FC44035EA8D47685FF3DF441E360
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7A58E0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 139COMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  APIs
                                                                                                                                                  • GetTempPathW.KERNEL32(?,00000000,?,00007FF73D7A58AD), ref: 00007FF73D7A597A
                                                                                                                                                  • GetCurrentProcessId.KERNEL32(?,00007FF73D7A58AD), ref: 00007FF73D7A5980
                                                                                                                                                    • Part of subcall function 00007FF73D7A5AF0: GetEnvironmentVariableW.KERNEL32(00007FF73D7A2817,?,?,?,?,?,?), ref: 00007FF73D7A5B2A
                                                                                                                                                    • Part of subcall function 00007FF73D7A5AF0: ExpandEnvironmentStringsW.KERNEL32(?,?,?,?,?,?), ref: 00007FF73D7A5B47
                                                                                                                                                    • Part of subcall function 00007FF73D7B6818: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73D7B6831
                                                                                                                                                  • SetEnvironmentVariableW.KERNEL32(?,TokenIntegrityLevel), ref: 00007FF73D7A5A31
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Environment$Variable$CurrentExpandPathProcessStringsTemp_invalid_parameter_noinfo
                                                                                                                                                  • String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
                                                                                                                                                  • API String ID: 1556224225-1116378104
                                                                                                                                                  • Opcode ID: ec9df767df1d7ad63378cf9061c4f1b0c2791a030b8388df183876306d084e69
                                                                                                                                                  • Instruction ID: 78d302aa24c31cb0675fec92773ab3791572cfcb0d35809826cf7892d8883227
                                                                                                                                                  • Opcode Fuzzy Hash: ec9df767df1d7ad63378cf9061c4f1b0c2791a030b8388df183876306d084e69
                                                                                                                                                  • Instruction Fuzzy Hash: 8D516810B0D64A74EE54BBE2A9552BAD2A16F5DBD4FC44031ED0E4BB96FF2CF401A320
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7C5DEC Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  • Executed
                                                                                                                                                  • Not Executed
                                                                                                                                                  control_flow_graph 390 7ff73d7c5dec-7ff73d7c5e5f call 7ff73d7c5b20 393 7ff73d7c5e61-7ff73d7c5e6a call 7ff73d7b6068 390->393 394 7ff73d7c5e79-7ff73d7c5e83 call 7ff73d7b6e60 390->394 399 7ff73d7c5e6d-7ff73d7c5e74 call 7ff73d7b6088 393->399 400 7ff73d7c5e85-7ff73d7c5e9c call 7ff73d7b6068 call 7ff73d7b6088 394->400 401 7ff73d7c5e9e-7ff73d7c5f07 CreateFileW 394->401 413 7ff73d7c61ba-7ff73d7c61da 399->413 400->399 404 7ff73d7c5f84-7ff73d7c5f8f GetFileType 401->404 405 7ff73d7c5f09-7ff73d7c5f0f 401->405 407 7ff73d7c5fe2-7ff73d7c5fe9 404->407 408 7ff73d7c5f91-7ff73d7c5fcc GetLastError call 7ff73d7b5ffc CloseHandle 404->408 410 7ff73d7c5f51-7ff73d7c5f7f GetLastError call 7ff73d7b5ffc 405->410 411 7ff73d7c5f11-7ff73d7c5f15 405->411 416 7ff73d7c5ff1-7ff73d7c5ff4 407->416 417 7ff73d7c5feb-7ff73d7c5fef 407->417 408->399 424 7ff73d7c5fd2-7ff73d7c5fdd call 7ff73d7b6088 408->424 410->399 411->410 418 7ff73d7c5f17-7ff73d7c5f4f CreateFileW 411->418 422 7ff73d7c5ffa-7ff73d7c604f call 7ff73d7b6d78 416->422 423 7ff73d7c5ff6 416->423 417->422 418->404 418->410 428 7ff73d7c6051-7ff73d7c605d call 7ff73d7c5d28 422->428 429 7ff73d7c606e-7ff73d7c609f call 7ff73d7c58a0 422->429 423->422 424->399 428->429 435 7ff73d7c605f 428->435 436 7ff73d7c60a1-7ff73d7c60a3 429->436 437 7ff73d7c60a5-7ff73d7c60e7 429->437 438 7ff73d7c6061-7ff73d7c6069 call 7ff73d7ba0f0 435->438 436->438 439 7ff73d7c6109-7ff73d7c6114 437->439 440 7ff73d7c60e9-7ff73d7c60ed 437->440 438->413 441 7ff73d7c611a-7ff73d7c611e 439->441 442 7ff73d7c61b8 439->442 440->439 444 7ff73d7c60ef-7ff73d7c6104 440->444 441->442 445 7ff73d7c6124-7ff73d7c6169 CloseHandle CreateFileW 441->445 442->413 444->439 447 7ff73d7c619e-7ff73d7c61b3 445->447 448 7ff73d7c616b-7ff73d7c6199 GetLastError call 7ff73d7b5ffc call 7ff73d7b6fa0 445->448 447->442 448->447
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1617910340-0
                                                                                                                                                  • Opcode ID: 52a4378cdb78c32285671ba8c66096e739a338fe2dbd84037285ee5c330aca07
                                                                                                                                                  • Instruction ID: 05b991d51b8a46ce259d5d0b97b1bba063a714ceef46b3a785dfc098d738f835
                                                                                                                                                  • Opcode Fuzzy Hash: 52a4378cdb78c32285671ba8c66096e739a338fe2dbd84037285ee5c330aca07
                                                                                                                                                  • Instruction Fuzzy Hash: 36C1F432B28A4A9AEB10DFA4C4805AC7761F74DBA8F800235DE5E5B795EF39E051D310
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7C511C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  • Executed
                                                                                                                                                  • Not Executed
                                                                                                                                                  control_flow_graph 795 7ff73d7c511c-7ff73d7c5151 call 7ff73d7c4828 call 7ff73d7c4830 call 7ff73d7c4898 802 7ff73d7c528f-7ff73d7c52fd call 7ff73d7b9f30 call 7ff73d7c0738 795->802 803 7ff73d7c5157-7ff73d7c5162 call 7ff73d7c4838 795->803 815 7ff73d7c52ff-7ff73d7c5306 802->815 816 7ff73d7c530b-7ff73d7c530e 802->816 803->802 808 7ff73d7c5168-7ff73d7c5173 call 7ff73d7c4868 803->808 808->802 814 7ff73d7c5179-7ff73d7c519c call 7ff73d7b9f78 GetTimeZoneInformation 808->814 829 7ff73d7c51a2-7ff73d7c51c3 814->829 830 7ff73d7c5264-7ff73d7c528e call 7ff73d7c4820 call 7ff73d7c4810 call 7ff73d7c4818 814->830 817 7ff73d7c539b-7ff73d7c539e 815->817 818 7ff73d7c5310 816->818 819 7ff73d7c5345-7ff73d7c5358 call 7ff73d7bcc2c 816->819 822 7ff73d7c53a4-7ff73d7c53ac call 7ff73d7c4ea0 817->822 823 7ff73d7c5313 817->823 818->823 833 7ff73d7c5363-7ff73d7c537e call 7ff73d7c0738 819->833 834 7ff73d7c535a 819->834 827 7ff73d7c5318-7ff73d7c5344 call 7ff73d7b9f78 call 7ff73d7aa100 822->827 823->827 828 7ff73d7c5313 call 7ff73d7c511c 823->828 828->827 836 7ff73d7c51c5-7ff73d7c51cb 829->836 837 7ff73d7c51ce-7ff73d7c51d5 829->837 854 7ff73d7c5380-7ff73d7c5383 833->854 855 7ff73d7c5385-7ff73d7c5397 call 7ff73d7b9f78 833->855 842 7ff73d7c535c-7ff73d7c5361 call 7ff73d7b9f78 834->842 836->837 838 7ff73d7c51e9 837->838 839 7ff73d7c51d7-7ff73d7c51df 837->839 846 7ff73d7c51eb-7ff73d7c525f call 7ff73d7ab880 * 4 call 7ff73d7c1cfc call 7ff73d7c53b4 * 2 838->846 839->838 844 7ff73d7c51e1-7ff73d7c51e7 839->844 842->818 844->846 846->830 854->842 855->817
                                                                                                                                                  APIs
                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF73D7C514A
                                                                                                                                                    • Part of subcall function 00007FF73D7C4898: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73D7C48AC
                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF73D7C515B
                                                                                                                                                    • Part of subcall function 00007FF73D7C4838: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73D7C484C
                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF73D7C516C
                                                                                                                                                    • Part of subcall function 00007FF73D7C4868: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73D7C487C
                                                                                                                                                    • Part of subcall function 00007FF73D7B9F78: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF73D7C1EC2,?,?,?,00007FF73D7C1EFF,?,?,00000000,00007FF73D7C23C5,?,?,00000000,00007FF73D7C22F7), ref: 00007FF73D7B9F8E
                                                                                                                                                    • Part of subcall function 00007FF73D7B9F78: GetLastError.KERNEL32(?,?,?,00007FF73D7C1EC2,?,?,?,00007FF73D7C1EFF,?,?,00000000,00007FF73D7C23C5,?,?,00000000,00007FF73D7C22F7), ref: 00007FF73D7B9F98
                                                                                                                                                  • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF73D7C53AC), ref: 00007FF73D7C5193
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _get_daylight_invalid_parameter_noinfo$ErrorInformationLanguagesLastPreferredRestoreThreadTimeZone
                                                                                                                                                  • String ID: W. Europe Standard Time$W. Europe Summer Time
                                                                                                                                                  • API String ID: 2248164782-690618308
                                                                                                                                                  • Opcode ID: 745ef94ea7204a2bfbd30c29007a49fe20bc82f24fe0203fc347e73c8b1ad169
                                                                                                                                                  • Instruction ID: dd971b74f90df43dbb840c2febaf66e860e90053ef6bbc71420a5751370b17d9
                                                                                                                                                  • Opcode Fuzzy Hash: 745ef94ea7204a2bfbd30c29007a49fe20bc82f24fe0203fc347e73c8b1ad169
                                                                                                                                                  • Instruction Fuzzy Hash: E8517132A1C64AAAE720FFA5D8901A9F760FB4C794FC04135EA8D47695EF3CF4009760
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7A69E0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Find$CloseFileFirst
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2295610775-0
                                                                                                                                                  • Opcode ID: 0b7e5a9930ef76a70c4e782aa580d8521c3892be20b9910ca6b4e20049941746
                                                                                                                                                  • Instruction ID: a53b729fb6cdd79039dd00217b579c458f275e1b207e74658187815b07bdad6b
                                                                                                                                                  • Opcode Fuzzy Hash: 0b7e5a9930ef76a70c4e782aa580d8521c3892be20b9910ca6b4e20049941746
                                                                                                                                                  • Instruction Fuzzy Hash: E7F0A432A1CB8596E7B09FA0E45876AB350BB88764F804335D6AD027D4EF3CE4499B10
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7A17B0 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 144COMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _fread_nolock$_invalid_parameter_noinfo
                                                                                                                                                  • String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
                                                                                                                                                  • API String ID: 3405171723-4158440160
                                                                                                                                                  • Opcode ID: 835103007f02c9749ac647d58f048ab1686cef21957037b090b7deb9b795050b
                                                                                                                                                  • Instruction ID: 253f66822e3f6f349930bf0b2bb80f4b459ad96d7b14b7d5bd94ffd4174cfa76
                                                                                                                                                  • Opcode Fuzzy Hash: 835103007f02c9749ac647d58f048ab1686cef21957037b090b7deb9b795050b
                                                                                                                                                  • Instruction Fuzzy Hash: D9517D72A0DA0AA6EB54EF64D450178B3A0FB4CB58B918136DA4D87395EF3CF444D760
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7A1440 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 133COMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  • Executed
                                                                                                                                                  • Not Executed
                                                                                                                                                  control_flow_graph 53 7ff73d7a1440-7ff73d7a1457 call 7ff73d7a5880 56 7ff73d7a1462-7ff73d7a1485 call 7ff73d7a5ba0 53->56 57 7ff73d7a1459-7ff73d7a1461 53->57 60 7ff73d7a14a7-7ff73d7a14ad 56->60 61 7ff73d7a1487-7ff73d7a14a2 call 7ff73d7a1c10 56->61 63 7ff73d7a14e0-7ff73d7a14f4 call 7ff73d7aec94 60->63 64 7ff73d7a14af-7ff73d7a14ba call 7ff73d7a2de0 60->64 69 7ff73d7a1635-7ff73d7a1647 61->69 71 7ff73d7a1516-7ff73d7a151a 63->71 72 7ff73d7a14f6-7ff73d7a1511 call 7ff73d7a1c10 63->72 70 7ff73d7a14bf-7ff73d7a14c5 64->70 70->63 73 7ff73d7a14c7-7ff73d7a14db call 7ff73d7a1c50 70->73 75 7ff73d7a1534-7ff73d7a1554 call 7ff73d7b414c 71->75 76 7ff73d7a151c-7ff73d7a1528 call 7ff73d7a1050 71->76 82 7ff73d7a1617-7ff73d7a161d 72->82 73->82 87 7ff73d7a1556-7ff73d7a1570 call 7ff73d7a1c10 75->87 88 7ff73d7a1575-7ff73d7a157b 75->88 83 7ff73d7a152d-7ff73d7a152f 76->83 85 7ff73d7a161f call 7ff73d7ae60c 82->85 86 7ff73d7a162b-7ff73d7a162e call 7ff73d7ae60c 82->86 83->82 97 7ff73d7a1624 85->97 98 7ff73d7a1633 86->98 99 7ff73d7a160d-7ff73d7a1612 87->99 89 7ff73d7a1581-7ff73d7a1586 88->89 90 7ff73d7a1605-7ff73d7a1608 call 7ff73d7b4138 88->90 96 7ff73d7a1590-7ff73d7a15b2 call 7ff73d7ae95c 89->96 90->99 102 7ff73d7a15b4-7ff73d7a15cc call 7ff73d7af09c 96->102 103 7ff73d7a15e5-7ff73d7a15ec 96->103 97->86 98->69 99->82 108 7ff73d7a15d5-7ff73d7a15e3 102->108 109 7ff73d7a15ce-7ff73d7a15d1 102->109 105 7ff73d7a15f3-7ff73d7a15fb call 7ff73d7a1c10 103->105 111 7ff73d7a1600 105->111 108->105 109->96 112 7ff73d7a15d3 109->112 111->90 112->111
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID: Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                                                                                                                                  • API String ID: 0-666925554
                                                                                                                                                  • Opcode ID: 9960f63575f751e35a3844e99a4979cf69418d4c573dd41fa87a4345e49a5c97
                                                                                                                                                  • Instruction ID: 481a343d180af8dca95f6785f88a6ef222e1ecc457756f566588caaab900ea68
                                                                                                                                                  • Opcode Fuzzy Hash: 9960f63575f751e35a3844e99a4979cf69418d4c573dd41fa87a4345e49a5c97
                                                                                                                                                  • Instruction Fuzzy Hash: 98519B21B0C64AA5FA10BBA1A4146B9E3A0BF49BE8FC54431DE5D47795FF3CF149A320
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7A6A60 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 91COMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen
                                                                                                                                                  • String ID: D:(A;;FA;;;%s)$S-1-3-4
                                                                                                                                                  • API String ID: 4998090-2855260032
                                                                                                                                                  • Opcode ID: 04a4952acd007a2d57849bf4a7f549880b035f2fca275a5dfd27a02a5c87a0f0
                                                                                                                                                  • Instruction ID: 47a29afdb2c347df1fd09069e77d1222c6ec10a8bc20925fa0887846edc1a1fa
                                                                                                                                                  • Opcode Fuzzy Hash: 04a4952acd007a2d57849bf4a7f549880b035f2fca275a5dfd27a02a5c87a0f0
                                                                                                                                                  • Instruction Fuzzy Hash: 8C41863161CA8A95E750AF90E4446AAB361FB887A4FD00231E99E47BD4FF3CF449D720
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7A6130 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90processsynchronizationCOMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
                                                                                                                                                  • String ID: CreateProcessW$Error creating child process!
                                                                                                                                                  • API String ID: 2895956056-3524285272
                                                                                                                                                  • Opcode ID: d5693698e4819ce5d510509d5cda6c943b390b1bcdb6e918232fd1435297541c
                                                                                                                                                  • Instruction ID: 6b402114e684e3abb3628e1f36c36bd00d3bae0638bbf482adeb6fe004d4acb9
                                                                                                                                                  • Opcode Fuzzy Hash: d5693698e4819ce5d510509d5cda6c943b390b1bcdb6e918232fd1435297541c
                                                                                                                                                  • Instruction Fuzzy Hash: BE411531A0CB8695DA20ABA0F4552AAF360FB98364F900335E6AD43BD5EF7CE0449B10
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7A1000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 274COMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  • Executed
                                                                                                                                                  • Not Executed
                                                                                                                                                  control_flow_graph 453 7ff73d7a1000-7ff73d7a27b6 call 7ff73d7ae3e0 call 7ff73d7ae3d8 call 7ff73d7a67c0 call 7ff73d7aa130 call 7ff73d7b4310 call 7ff73d7b4f7c call 7ff73d7a1af0 469 7ff73d7a28ca 453->469 470 7ff73d7a27bc-7ff73d7a27cb call 7ff73d7a2cd0 453->470 471 7ff73d7a28cf-7ff73d7a28ef call 7ff73d7aa100 469->471 470->469 476 7ff73d7a27d1-7ff73d7a27e4 call 7ff73d7a2ba0 470->476 476->469 479 7ff73d7a27ea-7ff73d7a27fd call 7ff73d7a2c50 476->479 479->469 482 7ff73d7a2803-7ff73d7a282a call 7ff73d7a5af0 479->482 485 7ff73d7a286c-7ff73d7a2894 call 7ff73d7a60f0 call 7ff73d7a19d0 482->485 486 7ff73d7a282c-7ff73d7a283b call 7ff73d7a5af0 482->486 496 7ff73d7a289a-7ff73d7a28b0 call 7ff73d7a19d0 485->496 497 7ff73d7a297d-7ff73d7a298e 485->497 486->485 492 7ff73d7a283d-7ff73d7a2843 486->492 494 7ff73d7a284f-7ff73d7a2869 call 7ff73d7b4138 call 7ff73d7a60f0 492->494 495 7ff73d7a2845-7ff73d7a284d 492->495 494->485 495->494 509 7ff73d7a28f0-7ff73d7a28f3 496->509 510 7ff73d7a28b2-7ff73d7a28c5 call 7ff73d7a1c50 496->510 501 7ff73d7a2990-7ff73d7a299a call 7ff73d7a24a0 497->501 502 7ff73d7a29a3-7ff73d7a29bb call 7ff73d7a6db0 497->502 512 7ff73d7a299c 501->512 513 7ff73d7a29db-7ff73d7a29e8 call 7ff73d7a4fa0 501->513 514 7ff73d7a29ce-7ff73d7a29d5 SetDllDirectoryW 502->514 515 7ff73d7a29bd-7ff73d7a29c9 call 7ff73d7a1c50 502->515 509->497 517 7ff73d7a28f9-7ff73d7a2910 call 7ff73d7a2de0 509->517 510->469 512->502 526 7ff73d7a2a36-7ff73d7a2a3b call 7ff73d7a4f20 513->526 527 7ff73d7a29ea-7ff73d7a29fa call 7ff73d7a4c40 513->527 514->513 515->469 524 7ff73d7a2912-7ff73d7a2915 517->524 525 7ff73d7a2917-7ff73d7a2943 call 7ff73d7a6360 517->525 528 7ff73d7a2952-7ff73d7a2968 call 7ff73d7a1c50 524->528 536 7ff73d7a2945-7ff73d7a294d call 7ff73d7ae60c 525->536 537 7ff73d7a296d-7ff73d7a297b 525->537 534 7ff73d7a2a40-7ff73d7a2a43 526->534 527->526 541 7ff73d7a29fc-7ff73d7a2a0b call 7ff73d7a47a0 527->541 528->469 539 7ff73d7a2af6-7ff73d7a2b05 call 7ff73d7a2330 534->539 540 7ff73d7a2a49-7ff73d7a2a56 534->540 536->528 537->501 539->469 555 7ff73d7a2b0b-7ff73d7a2b42 call 7ff73d7a6080 call 7ff73d7a5af0 call 7ff73d7a4540 539->555 545 7ff73d7a2a60-7ff73d7a2a6a 540->545 553 7ff73d7a2a2c-7ff73d7a2a31 call 7ff73d7a49f0 541->553 554 7ff73d7a2a0d-7ff73d7a2a19 call 7ff73d7a4730 541->554 549 7ff73d7a2a73-7ff73d7a2a75 545->549 550 7ff73d7a2a6c-7ff73d7a2a71 545->550 551 7ff73d7a2ac1-7ff73d7a2af1 call 7ff73d7a2490 call 7ff73d7a22d0 call 7ff73d7a2480 call 7ff73d7a49f0 call 7ff73d7a4f20 549->551 552 7ff73d7a2a77-7ff73d7a2a9a call 7ff73d7a1b30 549->552 550->545 550->549 551->471 552->469 565 7ff73d7a2aa0-7ff73d7a2aab 552->565 553->526 554->553 566 7ff73d7a2a1b-7ff73d7a2a2a call 7ff73d7a4df0 554->566 555->469 578 7ff73d7a2b48-7ff73d7a2b7d call 7ff73d7a2490 call 7ff73d7a6130 call 7ff73d7a49f0 call 7ff73d7a4f20 555->578 569 7ff73d7a2ab0-7ff73d7a2abf 565->569 566->534 569->551 569->569 591 7ff73d7a2b7f-7ff73d7a2b82 call 7ff73d7a5df0 578->591 592 7ff73d7a2b87-7ff73d7a2b8a call 7ff73d7a1ab0 578->592 591->592 595 7ff73d7a2b8f-7ff73d7a2b91 592->595 595->471
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 00007FF73D7A2CD0: GetModuleFileNameW.KERNEL32(?,00007FF73D7A27C9,?,?,?,?,?,?), ref: 00007FF73D7A2D01
                                                                                                                                                  • SetDllDirectoryW.KERNEL32 ref: 00007FF73D7A29D5
                                                                                                                                                    • Part of subcall function 00007FF73D7A5AF0: GetEnvironmentVariableW.KERNEL32(00007FF73D7A2817,?,?,?,?,?,?), ref: 00007FF73D7A5B2A
                                                                                                                                                    • Part of subcall function 00007FF73D7A5AF0: ExpandEnvironmentStringsW.KERNEL32(?,?,?,?,?,?), ref: 00007FF73D7A5B47
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
                                                                                                                                                  • String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
                                                                                                                                                  • API String ID: 2344891160-3602715111
                                                                                                                                                  • Opcode ID: cda1d3e5af6f259c5f9a2f0a335d6599039ecfe805480d258e6d0267492e8153
                                                                                                                                                  • Instruction ID: aae7a1149a70466cd18f49eaeb528e6c347d95ae5c10e41ff3e59072bca909f3
                                                                                                                                                  • Opcode Fuzzy Hash: cda1d3e5af6f259c5f9a2f0a335d6599039ecfe805480d258e6d0267492e8153
                                                                                                                                                  • Instruction Fuzzy Hash: B4C17222A1C68B75FA24BBA194512FDA391BF4C784FC05032EA4D47796FF2CF615A720
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7A1050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156COMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  • Executed
                                                                                                                                                  • Not Executed
                                                                                                                                                  control_flow_graph 596 7ff73d7a1050-7ff73d7a10ab call 7ff73d7a9990 599 7ff73d7a10d3-7ff73d7a10eb call 7ff73d7b414c 596->599 600 7ff73d7a10ad-7ff73d7a10d2 call 7ff73d7a1c50 596->600 605 7ff73d7a1109-7ff73d7a1119 call 7ff73d7b414c 599->605 606 7ff73d7a10ed-7ff73d7a1104 call 7ff73d7a1c10 599->606 612 7ff73d7a1137-7ff73d7a1147 605->612 613 7ff73d7a111b-7ff73d7a1132 call 7ff73d7a1c10 605->613 611 7ff73d7a126c-7ff73d7a1281 call 7ff73d7a9670 call 7ff73d7b4138 * 2 606->611 629 7ff73d7a1286-7ff73d7a12a0 611->629 616 7ff73d7a1150-7ff73d7a1175 call 7ff73d7ae95c 612->616 613->611 622 7ff73d7a117b-7ff73d7a1185 call 7ff73d7ae6d0 616->622 623 7ff73d7a125e 616->623 622->623 630 7ff73d7a118b-7ff73d7a1197 622->630 627 7ff73d7a1264 623->627 627->611 631 7ff73d7a11a0-7ff73d7a11c8 call 7ff73d7a7de0 630->631 634 7ff73d7a1241-7ff73d7a125c call 7ff73d7a1c50 631->634 635 7ff73d7a11ca-7ff73d7a11cd 631->635 634->627 636 7ff73d7a11cf-7ff73d7a11d9 635->636 637 7ff73d7a123c 635->637 639 7ff73d7a1203-7ff73d7a1206 636->639 640 7ff73d7a11db-7ff73d7a11e8 call 7ff73d7af09c 636->640 637->634 642 7ff73d7a1208-7ff73d7a1216 call 7ff73d7aaec0 639->642 643 7ff73d7a1219-7ff73d7a121e 639->643 647 7ff73d7a11ed-7ff73d7a11f0 640->647 642->643 643->631 646 7ff73d7a1220-7ff73d7a1223 643->646 649 7ff73d7a1225-7ff73d7a1228 646->649 650 7ff73d7a1237-7ff73d7a123a 646->650 651 7ff73d7a11f2-7ff73d7a11fc call 7ff73d7ae6d0 647->651 652 7ff73d7a11fe-7ff73d7a1201 647->652 649->634 653 7ff73d7a122a-7ff73d7a1232 649->653 650->627 651->643 651->652 652->634 653->616
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID: 1.2.13$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                                                  • API String ID: 0-1655038675
                                                                                                                                                  • Opcode ID: af04965e2dbcd0d8e1621cd66b39530d0b4f4ad9fcd8e07e4d45104bc70e5302
                                                                                                                                                  • Instruction ID: 5f2d5940081e6786cb7d0821df9bfca7ea7bf0fda4bddac639a9ad2d30221019
                                                                                                                                                  • Opcode Fuzzy Hash: af04965e2dbcd0d8e1621cd66b39530d0b4f4ad9fcd8e07e4d45104bc70e5302
                                                                                                                                                  • Instruction Fuzzy Hash: 64518022A0D68AA5FA60BB91E4403B9A291BB88794FC44135DE4D877C5FF3CF549E720
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BDF30 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  APIs
                                                                                                                                                  • FreeLibrary.KERNEL32(?,00000000,?,00007FF73D7BE2CA,?,?,-00000018,00007FF73D7BA383,?,?,?,00007FF73D7BA27A,?,?,?,00007FF73D7B54E2), ref: 00007FF73D7BE0AC
                                                                                                                                                  • GetProcAddress.KERNEL32(?,00000000,?,00007FF73D7BE2CA,?,?,-00000018,00007FF73D7BA383,?,?,?,00007FF73D7BA27A,?,?,?,00007FF73D7B54E2), ref: 00007FF73D7BE0B8
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: AddressFreeLibraryProc
                                                                                                                                                  • String ID: api-ms-$ext-ms-
                                                                                                                                                  • API String ID: 3013587201-537541572
                                                                                                                                                  • Opcode ID: 5d4014bca18f9f9ee9ee76f308e7221266f6712ab36b1d3e30b229e2872ef72f
                                                                                                                                                  • Instruction ID: a5d48aec32c7ec175a213d8bb1b94824a3f665acc227341ffb1a2daacbed434a
                                                                                                                                                  • Opcode Fuzzy Hash: 5d4014bca18f9f9ee9ee76f308e7221266f6712ab36b1d3e30b229e2872ef72f
                                                                                                                                                  • Instruction Fuzzy Hash: 58415622B2DA1AA5FA19EB969800675A391BF1CBE0FD84135DD5D87384FF3CF445A320
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BB08C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  • Executed
                                                                                                                                                  • Not Executed
                                                                                                                                                  control_flow_graph 682 7ff73d7bb08c-7ff73d7bb0b2 683 7ff73d7bb0b4-7ff73d7bb0c8 call 7ff73d7b6068 call 7ff73d7b6088 682->683 684 7ff73d7bb0cd-7ff73d7bb0d1 682->684 700 7ff73d7bb4be 683->700 686 7ff73d7bb4a7-7ff73d7bb4b3 call 7ff73d7b6068 call 7ff73d7b6088 684->686 687 7ff73d7bb0d7-7ff73d7bb0de 684->687 706 7ff73d7bb4b9 call 7ff73d7b9f10 686->706 687->686 689 7ff73d7bb0e4-7ff73d7bb112 687->689 689->686 692 7ff73d7bb118-7ff73d7bb11f 689->692 695 7ff73d7bb121-7ff73d7bb133 call 7ff73d7b6068 call 7ff73d7b6088 692->695 696 7ff73d7bb138-7ff73d7bb13b 692->696 695->706 698 7ff73d7bb141-7ff73d7bb147 696->698 699 7ff73d7bb4a3-7ff73d7bb4a5 696->699 698->699 704 7ff73d7bb14d-7ff73d7bb150 698->704 703 7ff73d7bb4c1-7ff73d7bb4d8 699->703 700->703 704->695 708 7ff73d7bb152-7ff73d7bb177 704->708 706->700 711 7ff73d7bb1aa-7ff73d7bb1b1 708->711 712 7ff73d7bb179-7ff73d7bb17b 708->712 713 7ff73d7bb186-7ff73d7bb19d call 7ff73d7b6068 call 7ff73d7b6088 call 7ff73d7b9f10 711->713 714 7ff73d7bb1b3-7ff73d7bb1db call 7ff73d7bcc2c call 7ff73d7b9f78 * 2 711->714 715 7ff73d7bb1a2-7ff73d7bb1a8 712->715 716 7ff73d7bb17d-7ff73d7bb184 712->716 748 7ff73d7bb330 713->748 743 7ff73d7bb1f8-7ff73d7bb223 call 7ff73d7bb8b4 714->743 744 7ff73d7bb1dd-7ff73d7bb1f3 call 7ff73d7b6088 call 7ff73d7b6068 714->744 719 7ff73d7bb228-7ff73d7bb23f 715->719 716->713 716->715 720 7ff73d7bb241-7ff73d7bb249 719->720 721 7ff73d7bb2ba-7ff73d7bb2c4 call 7ff73d7c2abc 719->721 720->721 724 7ff73d7bb24b-7ff73d7bb24d 720->724 734 7ff73d7bb2ca-7ff73d7bb2df 721->734 735 7ff73d7bb34e 721->735 724->721 728 7ff73d7bb24f-7ff73d7bb265 724->728 728->721 732 7ff73d7bb267-7ff73d7bb273 728->732 732->721 737 7ff73d7bb275-7ff73d7bb277 732->737 734->735 740 7ff73d7bb2e1-7ff73d7bb2f3 GetConsoleMode 734->740 739 7ff73d7bb353-7ff73d7bb373 ReadFile 735->739 737->721 742 7ff73d7bb279-7ff73d7bb291 737->742 745 7ff73d7bb379-7ff73d7bb381 739->745 746 7ff73d7bb46d-7ff73d7bb476 GetLastError 739->746 740->735 747 7ff73d7bb2f5-7ff73d7bb2fd 740->747 742->721 752 7ff73d7bb293-7ff73d7bb29f 742->752 743->719 744->748 745->746 754 7ff73d7bb387 745->754 749 7ff73d7bb493-7ff73d7bb496 746->749 750 7ff73d7bb478-7ff73d7bb48e call 7ff73d7b6088 call 7ff73d7b6068 746->750 747->739 756 7ff73d7bb2ff-7ff73d7bb321 ReadConsoleW 747->756 751 7ff73d7bb333-7ff73d7bb33d call 7ff73d7b9f78 748->751 762 7ff73d7bb329-7ff73d7bb32b call 7ff73d7b5ffc 749->762 763 7ff73d7bb49c-7ff73d7bb49e 749->763 750->748 751->703 752->721 761 7ff73d7bb2a1-7ff73d7bb2a3 752->761 765 7ff73d7bb38e-7ff73d7bb3a3 754->765 757 7ff73d7bb342-7ff73d7bb34c 756->757 758 7ff73d7bb323 GetLastError 756->758 757->765 758->762 761->721 770 7ff73d7bb2a5-7ff73d7bb2b5 761->770 762->748 763->751 765->751 772 7ff73d7bb3a5-7ff73d7bb3b0 765->772 770->721 775 7ff73d7bb3b2-7ff73d7bb3cb call 7ff73d7baca4 772->775 776 7ff73d7bb3d7-7ff73d7bb3df 772->776 781 7ff73d7bb3d0-7ff73d7bb3d2 775->781 777 7ff73d7bb3e1-7ff73d7bb3f3 776->777 778 7ff73d7bb45b-7ff73d7bb468 call 7ff73d7baae4 776->778 782 7ff73d7bb3f5 777->782 783 7ff73d7bb44e-7ff73d7bb456 777->783 778->781 781->751 786 7ff73d7bb3fa-7ff73d7bb401 782->786 783->751 787 7ff73d7bb403-7ff73d7bb407 786->787 788 7ff73d7bb43d-7ff73d7bb448 786->788 789 7ff73d7bb423 787->789 790 7ff73d7bb409-7ff73d7bb410 787->790 788->783 792 7ff73d7bb429-7ff73d7bb439 789->792 790->789 791 7ff73d7bb412-7ff73d7bb416 790->791 791->789 793 7ff73d7bb418-7ff73d7bb421 791->793 792->786 794 7ff73d7bb43b 792->794 793->792 794->783
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                  • Opcode ID: 5e2fa04a27a554ad5a06cbbe01d601b05b68f3aeb2922c25288f770f6f319bba
                                                                                                                                                  • Instruction ID: 4abb210d8458dfb35c3cc1d39a417f16e737bf044167b41653809584b7eae96f
                                                                                                                                                  • Opcode Fuzzy Hash: 5e2fa04a27a554ad5a06cbbe01d601b05b68f3aeb2922c25288f770f6f319bba
                                                                                                                                                  • Instruction Fuzzy Hash: 7BC1082290C64E61E722AB9594482BDB751FBA9B80FD50131EE8D07791EF7CF449E320
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BC590 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  • Executed
                                                                                                                                                  • Not Executed
                                                                                                                                                  control_flow_graph 872 7ff73d7bc590-7ff73d7bc5b5 873 7ff73d7bc883 872->873 874 7ff73d7bc5bb-7ff73d7bc5be 872->874 875 7ff73d7bc885-7ff73d7bc895 873->875 876 7ff73d7bc5c0-7ff73d7bc5f2 call 7ff73d7b9e44 874->876 877 7ff73d7bc5f7-7ff73d7bc623 874->877 876->875 879 7ff73d7bc625-7ff73d7bc62c 877->879 880 7ff73d7bc62e-7ff73d7bc634 877->880 879->876 879->880 882 7ff73d7bc636-7ff73d7bc63f call 7ff73d7bb950 880->882 883 7ff73d7bc644-7ff73d7bc659 call 7ff73d7c2abc 880->883 882->883 887 7ff73d7bc65f-7ff73d7bc668 883->887 888 7ff73d7bc773-7ff73d7bc77c 883->888 887->888 889 7ff73d7bc66e-7ff73d7bc672 887->889 890 7ff73d7bc7d0-7ff73d7bc7f5 WriteFile 888->890 891 7ff73d7bc77e-7ff73d7bc784 888->891 894 7ff73d7bc674-7ff73d7bc67c call 7ff73d7b3830 889->894 895 7ff73d7bc683-7ff73d7bc68e 889->895 896 7ff73d7bc800 890->896 897 7ff73d7bc7f7-7ff73d7bc7fd GetLastError 890->897 892 7ff73d7bc786-7ff73d7bc789 891->892 893 7ff73d7bc7bc-7ff73d7bc7ce call 7ff73d7bc048 891->893 898 7ff73d7bc7a8-7ff73d7bc7ba call 7ff73d7bc268 892->898 899 7ff73d7bc78b-7ff73d7bc78e 892->899 920 7ff73d7bc760-7ff73d7bc767 893->920 894->895 901 7ff73d7bc690-7ff73d7bc699 895->901 902 7ff73d7bc69f-7ff73d7bc6b4 GetConsoleMode 895->902 904 7ff73d7bc803 896->904 897->896 898->920 905 7ff73d7bc814-7ff73d7bc81e 899->905 906 7ff73d7bc794-7ff73d7bc7a6 call 7ff73d7bc14c 899->906 901->888 901->902 909 7ff73d7bc6ba-7ff73d7bc6c0 902->909 910 7ff73d7bc76c 902->910 912 7ff73d7bc808 904->912 914 7ff73d7bc820-7ff73d7bc825 905->914 915 7ff73d7bc87c-7ff73d7bc881 905->915 906->920 918 7ff73d7bc6c6-7ff73d7bc6c9 909->918 919 7ff73d7bc749-7ff73d7bc75b call 7ff73d7bbbd0 909->919 910->888 913 7ff73d7bc80d 912->913 913->905 921 7ff73d7bc853-7ff73d7bc85d 914->921 922 7ff73d7bc827-7ff73d7bc82a 914->922 915->875 924 7ff73d7bc6d4-7ff73d7bc6e2 918->924 925 7ff73d7bc6cb-7ff73d7bc6ce 918->925 919->920 920->912 929 7ff73d7bc85f-7ff73d7bc862 921->929 930 7ff73d7bc864-7ff73d7bc873 921->930 927 7ff73d7bc843-7ff73d7bc84e call 7ff73d7b6044 922->927 928 7ff73d7bc82c-7ff73d7bc83b 922->928 931 7ff73d7bc740-7ff73d7bc744 924->931 932 7ff73d7bc6e4 924->932 925->913 925->924 927->921 928->927 929->873 929->930 930->915 931->904 934 7ff73d7bc6e8-7ff73d7bc6ff call 7ff73d7c2b88 932->934 938 7ff73d7bc701-7ff73d7bc70d 934->938 939 7ff73d7bc737-7ff73d7bc73d GetLastError 934->939 940 7ff73d7bc70f-7ff73d7bc721 call 7ff73d7c2b88 938->940 941 7ff73d7bc72c-7ff73d7bc733 938->941 939->931 940->939 945 7ff73d7bc723-7ff73d7bc72a 940->945 941->931 943 7ff73d7bc735 941->943 943->934 945->941
                                                                                                                                                  APIs
                                                                                                                                                  • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF73D7BC57B), ref: 00007FF73D7BC6AC
                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF73D7BC57B), ref: 00007FF73D7BC737
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ConsoleErrorLastMode
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 953036326-0
                                                                                                                                                  • Opcode ID: 1ee269c4fb3492fdab786e16ea0be33da994e1b3a3006f3c14cd8905a42bf150
                                                                                                                                                  • Instruction ID: 14713b6ca5f96d38d89900a7ab2817049fe3ee9c0c1074ee1b6d9d1dcfad9830
                                                                                                                                                  • Opcode Fuzzy Hash: 1ee269c4fb3492fdab786e16ea0be33da994e1b3a3006f3c14cd8905a42bf150
                                                                                                                                                  • Instruction Fuzzy Hash: D391C832E0C65AA5F750AFB5944027DA7A0FB68B88F948139EE4E57684EF38F441D720
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BE95C Relevance: 6.2, APIs: 4, Instructions: 162COMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _get_daylight$_isindst
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 4170891091-0
                                                                                                                                                  • Opcode ID: 993f4cb53d01987759aa9ab87d439edc94425a62c6450610c4994d1423bcdf7f
                                                                                                                                                  • Instruction ID: 023e201b58abf58582f42327d4877943cc7836e36954433d4f003d84484bc9ea
                                                                                                                                                  • Opcode Fuzzy Hash: 993f4cb53d01987759aa9ab87d439edc94425a62c6450610c4994d1423bcdf7f
                                                                                                                                                  • Instruction Fuzzy Hash: 0D516972F182195AFB18EFA4D851ABDA7A1AB28358F940135DD1F47BD0EF38B501DB00
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7B483C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2780335769-0
                                                                                                                                                  • Opcode ID: 81de7022a69b47ce39b5392d1784fece2718e2d2aab2765227a8e407644b98c7
                                                                                                                                                  • Instruction ID: c91557c8b89d67a92f2a11b696a4683178425248f3c64a72bb04d1c15936d844
                                                                                                                                                  • Opcode Fuzzy Hash: 81de7022a69b47ce39b5392d1784fece2718e2d2aab2765227a8e407644b98c7
                                                                                                                                                  • Instruction Fuzzy Hash: 7A51BD22E0C646AAFB10EFB0D4503BDA3A1BB5CB5CF908035DE4D57689EF38E4859760
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7B46E8 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1279662727-0
                                                                                                                                                  • Opcode ID: 58b178a13046118a9aa3eab3ad0445e857bf873c1952e3e12f7b4cc56e3b75ff
                                                                                                                                                  • Instruction ID: b568f7dd7fe2386bbbe20592a6efc1d613a31154cc1a92507e02d4342b02cb30
                                                                                                                                                  • Opcode Fuzzy Hash: 58b178a13046118a9aa3eab3ad0445e857bf873c1952e3e12f7b4cc56e3b75ff
                                                                                                                                                  • Instruction Fuzzy Hash: 7041C222D1C78597E710ABA09510379B360FBA97A8F908334E79C03AD1EF7CB4E09720
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7AA51C Relevance: 4.6, APIs: 3, Instructions: 102COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3058843127-0
                                                                                                                                                  • Opcode ID: 0a8c62a57e2cf59f1561fe537eeb51f2220189f8d74725526a3d26dbeb988a7e
                                                                                                                                                  • Instruction ID: 6506bc38d70cf4cf3ba8cc93d4fa138e899af3dbc8c4ce6f4be12d8257933380
                                                                                                                                                  • Opcode Fuzzy Hash: 0a8c62a57e2cf59f1561fe537eeb51f2220189f8d74725526a3d26dbeb988a7e
                                                                                                                                                  • Instruction Fuzzy Hash: 14313821E0C28AA6EA54BBE0D4123BAA291BF4D784FC44435EA4D47393FF2CB445A770
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7B89E8 Relevance: 4.5, APIs: 3, Instructions: 14COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Process$CurrentExitTerminate
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1703294689-0
                                                                                                                                                  • Opcode ID: fc68bfbf785dc4e8d02d30f22ac316467e06faf73d836825e3014864920bd8dd
                                                                                                                                                  • Instruction ID: 59741308a5176c070f84cd34da3ad558a5030ab20cd00259ed85331e3fffd813
                                                                                                                                                  • Opcode Fuzzy Hash: fc68bfbf785dc4e8d02d30f22ac316467e06faf73d836825e3014864920bd8dd
                                                                                                                                                  • Instruction Fuzzy Hash: 03D09E10B0C64AAAEB543BF1585917992516F9C762F841438C88F17393FF3DB84D6270
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7AE6FC Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                  • Opcode ID: a3600ff4682811ddeb36fb761298261c2e9791cf1ca8f4758584451e9995ac85
                                                                                                                                                  • Instruction ID: bf5cefecd58a8824fbe5ff991beb8f0fcafe1351405de923383375ec2ea08358
                                                                                                                                                  • Opcode Fuzzy Hash: a3600ff4682811ddeb36fb761298261c2e9791cf1ca8f4758584451e9995ac85
                                                                                                                                                  • Instruction Fuzzy Hash: F2510921F2D25A56F768BAA5940067AE181BF48BB4F884634DD7C077C5EF3CF401A721
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BBA48 Relevance: 3.1, APIs: 2, Instructions: 71COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: FileHandleType
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3000768030-0
                                                                                                                                                  • Opcode ID: 51d66a3ea3a1e5720d3031fa8d01ef1f6d3b4a26eee4bfd04239a76c9c1293a5
                                                                                                                                                  • Instruction ID: 9e6f93e8bea8158b100c1ce2930ce8726f03d36fd446219f97fea8e789d363b3
                                                                                                                                                  • Opcode Fuzzy Hash: 51d66a3ea3a1e5720d3031fa8d01ef1f6d3b4a26eee4bfd04239a76c9c1293a5
                                                                                                                                                  • Instruction Fuzzy Hash: D931D622E1CB4AA1D7219B548584179AA50FB5DBB0FA81339EF6E073E4DF38F491E310
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BA188 Relevance: 3.1, APIs: 2, Instructions: 59COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • FindCloseChangeNotification.KERNELBASE(?,?,?,00007FF73D7BA005,?,?,00000000,00007FF73D7BA0BA), ref: 00007FF73D7BA1F6
                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,00007FF73D7BA005,?,?,00000000,00007FF73D7BA0BA), ref: 00007FF73D7BA200
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ChangeCloseErrorFindLastNotification
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1687624791-0
                                                                                                                                                  • Opcode ID: 6fe57093fbbb00cdf8389479e1e18e52ea82cce6ea34632ee61e1d7ac301845a
                                                                                                                                                  • Instruction ID: 720975984a31862dbd6b806d2a14fb68b46e1fa4ba664aa7d704bd5eb6163b4c
                                                                                                                                                  • Opcode Fuzzy Hash: 6fe57093fbbb00cdf8389479e1e18e52ea82cce6ea34632ee61e1d7ac301845a
                                                                                                                                                  • Instruction Fuzzy Hash: CD219511B1C64A61FE9077D194902BD96A1AFAC7A0FC45235DA6D473C5FFACB4446310
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BB764 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • SetFilePointerEx.KERNELBASE(?,?,?,?,?,00007FF73D7BB750,00000000,?,?,?,00007FF73D7A1023,00007FF73D7BB859), ref: 00007FF73D7BB7B0
                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,?,?,00007FF73D7BB750,00000000,?,?,?,00007FF73D7A1023,00007FF73D7BB859), ref: 00007FF73D7BB7BA
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ErrorFileLastPointer
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2976181284-0
                                                                                                                                                  • Opcode ID: 7196098b30ecd42809471233c9619b7315c9fb41ce716e28bdee8d0b35162eb6
                                                                                                                                                  • Instruction ID: 9fe5712ef25d82b8c6fa35a5e7df89dc56d11b8ad7af2cc24ee1ba12a60ebebc
                                                                                                                                                  • Opcode Fuzzy Hash: 7196098b30ecd42809471233c9619b7315c9fb41ce716e28bdee8d0b35162eb6
                                                                                                                                                  • Instruction Fuzzy Hash: 0D11272270CB8691DA10AB66A408069E361FB58BF0FD44332EEBD0B7D8EF7CE0408700
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7B49E4 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF73D7B48F9), ref: 00007FF73D7B4A17
                                                                                                                                                  • SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF73D7B48F9), ref: 00007FF73D7B4A2D
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Time$System$FileLocalSpecific
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1707611234-0
                                                                                                                                                  • Opcode ID: 5359c6eadbc125880de5eb3a516e79e0ad43a75e61374d6be107f92d83a7530b
                                                                                                                                                  • Instruction ID: a9c5d0952685bd83c920b09168faec54f74208da43ecec94c1811ad3dc48a682
                                                                                                                                                  • Opcode Fuzzy Hash: 5359c6eadbc125880de5eb3a516e79e0ad43a75e61374d6be107f92d83a7530b
                                                                                                                                                  • Instruction Fuzzy Hash: 7D11A77260C65691EB54AB60A41113BF7A0FB98779F900235F6AE81AD4FF3CE054EB10
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7B6AE8 Relevance: 3.0, APIs: 2, Instructions: 35timeCOMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF73D7B6965), ref: 00007FF73D7B6B0B
                                                                                                                                                  • SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF73D7B6965), ref: 00007FF73D7B6B21
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Time$System$FileLocalSpecific
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1707611234-0
                                                                                                                                                  • Opcode ID: 4979fb33e8de5b56483d857dcf3248564858e1df126649fde4a887e8262e5eb8
                                                                                                                                                  • Instruction ID: e25eed4ae9d4b248afcfbc8e9a74a80532b205dfb14c96d8b0aec7200fa61662
                                                                                                                                                  • Opcode Fuzzy Hash: 4979fb33e8de5b56483d857dcf3248564858e1df126649fde4a887e8262e5eb8
                                                                                                                                                  • Instruction Fuzzy Hash: 4A015E3251C65596EB60AB54E40123FF7B1FB89761FA00235E7AA459D4EF3DE050EF20
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7B9F78 Relevance: 3.0, APIs: 2, Instructions: 19threadCOMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF73D7C1EC2,?,?,?,00007FF73D7C1EFF,?,?,00000000,00007FF73D7C23C5,?,?,00000000,00007FF73D7C22F7), ref: 00007FF73D7B9F8E
                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,00007FF73D7C1EC2,?,?,?,00007FF73D7C1EFF,?,?,00000000,00007FF73D7C23C5,?,?,00000000,00007FF73D7C22F7), ref: 00007FF73D7B9F98
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ErrorLanguagesLastPreferredRestoreThread
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 588628887-0
                                                                                                                                                  • Opcode ID: 38b70030576bf13f94cd83556ee530387765cecd0e7570bb2763cadcf4087263
                                                                                                                                                  • Instruction ID: 008de9536a28f74c30840b936b64a730ce37cfb2e30a3de9292cee5a1a4b2691
                                                                                                                                                  • Opcode Fuzzy Hash: 38b70030576bf13f94cd83556ee530387765cecd0e7570bb2763cadcf4087263
                                                                                                                                                  • Instruction Fuzzy Hash: 7CE08650F0D50B66FF147BF29848078D561AF9C751BC40034D95D47251FF3CB889A230
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7B70D4 Relevance: 3.0, APIs: 2, Instructions: 12fileCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: DeleteErrorFileLast
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2018770650-0
                                                                                                                                                  • Opcode ID: d9df61864aacf0c38aa57b7a7eccc268b2766f97fd3960567bd6780660c5006e
                                                                                                                                                  • Instruction ID: 9c54500ff7b0e364ae666967de9fb437811a4f8da1a73b90e3616d47c381cf78
                                                                                                                                                  • Opcode Fuzzy Hash: d9df61864aacf0c38aa57b7a7eccc268b2766f97fd3960567bd6780660c5006e
                                                                                                                                                  • Instruction Fuzzy Hash: 0AD0C910E1D60BA5E61437F51C891B995906F6C771FD00635D46A852D0FF2CB0C92121
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7B6850 Relevance: 3.0, APIs: 2, Instructions: 12COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: DirectoryErrorLastRemove
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 377330604-0
                                                                                                                                                  • Opcode ID: f10b0acbf04ce372ff2bba8e22346aa2cd94a9581c077f1b6ddec38c1268e9e8
                                                                                                                                                  • Instruction ID: 015c2b283e4633932419ca941adcdb462ddb9c1e2029cc28acb28f6fed1532f1
                                                                                                                                                  • Opcode Fuzzy Hash: f10b0acbf04ce372ff2bba8e22346aa2cd94a9581c077f1b6ddec38c1268e9e8
                                                                                                                                                  • Instruction Fuzzy Hash: D6D0C910E5D91BA5EA2437F11C4517C94A03F6C771FD00634C169862D0FF2CF4C92121
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7A5DF0 Relevance: 1.6, APIs: 1, Instructions: 141COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ByteCharMultiWide_findclose
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2772937645-0
                                                                                                                                                  • Opcode ID: 628285328bb618edcfe9754a4ff814bb64e2feda71a532fcc2d8bd8f687e193b
                                                                                                                                                  • Instruction ID: a622a174a3d161f705e5c840bebbd83b4d12702201342bf10184817a938f4e53
                                                                                                                                                  • Opcode Fuzzy Hash: 628285328bb618edcfe9754a4ff814bb64e2feda71a532fcc2d8bd8f687e193b
                                                                                                                                                  • Instruction Fuzzy Hash: 42717052E1CAC591EA11DB2CC5052FDA370F7A9B48F94E325DB9C12652FF28E2D5C700
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BB4DC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                  • Opcode ID: 3cb10c43647639a768565940e1ce5c449de1869fbc1a92892aa118bde093882e
                                                                                                                                                  • Instruction ID: 517d932d23769ba1c459684f826121b752213ba741d90c28d5b1a8ffb3eb48fe
                                                                                                                                                  • Opcode Fuzzy Hash: 3cb10c43647639a768565940e1ce5c449de1869fbc1a92892aa118bde093882e
                                                                                                                                                  • Instruction Fuzzy Hash: 0941F53290C64997EA35EB99A545179F3A0EF7AB44F940131DA8E836D0EF2CF402D761
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7A6360 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _fread_nolock
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 840049012-0
                                                                                                                                                  • Opcode ID: f285b20302beaefcf1bb3539b442360c68e2f6062702bb5b73d900193ad1ebd1
                                                                                                                                                  • Instruction ID: ff08a9ade6575cdb7e99cc50919c6722b45082b43a1caf98e1b5ae9141df743e
                                                                                                                                                  • Opcode Fuzzy Hash: f285b20302beaefcf1bb3539b442360c68e2f6062702bb5b73d900193ad1ebd1
                                                                                                                                                  • Instruction Fuzzy Hash: A421A221B1CA9A66EA24BB9269043BEE651BF49BC4FC84430EE0C07786EF3CF1459610
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BAF6C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                  • Opcode ID: ff4bd6b019ced27284b6fa2760217448de45b7808968d4935831090a049e7df0
                                                                                                                                                  • Instruction ID: 775eefcb58c7010862e085f5705da31cf3a6f26b1618e4c8eb30da5033f83ba6
                                                                                                                                                  • Opcode Fuzzy Hash: ff4bd6b019ced27284b6fa2760217448de45b7808968d4935831090a049e7df0
                                                                                                                                                  • Instruction Fuzzy Hash: 0931C561A1C60AA5E7217BD684403BCAA50BB6DB50FC10135EA9D073D2EFBCF446A330
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7B8919 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: HandleModule$AddressFreeLibraryProc
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3947729631-0
                                                                                                                                                  • Opcode ID: 7474e071a48ef7130f5acd4d7b35ddfbaeb0d66e7037ac086cf5d56d8c80b409
                                                                                                                                                  • Instruction ID: 775c63a974944b002aef68a48c7381feda699859f858bcbbc337567a8d685faf
                                                                                                                                                  • Opcode Fuzzy Hash: 7474e071a48ef7130f5acd4d7b35ddfbaeb0d66e7037ac086cf5d56d8c80b409
                                                                                                                                                  • Instruction Fuzzy Hash: 3C21A172E0870A9AEB24AFA4C4442FC77B0EB18718F881636D65D06AC5EF38E444D7A1
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7B5538 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                  • Opcode ID: 25f020cec256df429067bb606d051891f0f83e0bb8faa834007163ccabd97c9c
                                                                                                                                                  • Instruction ID: e174bde111b7000417c003b7b92e9001e6ad9bc835f14afad58af2176a201aec
                                                                                                                                                  • Opcode Fuzzy Hash: 25f020cec256df429067bb606d051891f0f83e0bb8faa834007163ccabd97c9c
                                                                                                                                                  • Instruction Fuzzy Hash: A0118121A1C64991EA60BF91940127DE260FFA9BC0FC84431EB8C57A86EF7DF8016760
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7C57DC Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                  • Opcode ID: e860bb9bc84c29a06dccfc010b7eb52daf61d2c250f48aeb7393b4a8ace16f10
                                                                                                                                                  • Instruction ID: f8ca7ac263bc340faa61b88183489ee1a67271bb09b8e842157e9f26a7616a4d
                                                                                                                                                  • Opcode Fuzzy Hash: e860bb9bc84c29a06dccfc010b7eb52daf61d2c250f48aeb7393b4a8ace16f10
                                                                                                                                                  • Instruction Fuzzy Hash: 2A21D732A1CA459BDB61AF58D440379B6A0FB88BA4FD44234E79D476D9EF3DE4009B10
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7AE97C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                  • Opcode ID: 298f7b2a666c55937c0a4044f00fb88544ba948c427ceaa5fd6043e577695ec0
                                                                                                                                                  • Instruction ID: 3c7e5f1cece18e3a4ffeb2a89911fbfa3b7107d67d380c2fdf27fd84a1826db4
                                                                                                                                                  • Opcode Fuzzy Hash: 298f7b2a666c55937c0a4044f00fb88544ba948c427ceaa5fd6043e577695ec0
                                                                                                                                                  • Instruction Fuzzy Hash: FD01E121B1C75951EA44BBA29800069E691AB9AFE0F884631DE6C17BD6EF3CF0019310
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BDEB8 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • RtlAllocateHeap.NTDLL(?,?,00000000,00007FF73D7BAA16,?,?,?,00007FF73D7B9BD3,?,?,00000000,00007FF73D7B9E6E), ref: 00007FF73D7BDF0D
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: AllocateHeap
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1279760036-0
                                                                                                                                                  • Opcode ID: 69550027ed8e3bf035e7bef6798a6f7658c1153be72ca181ca789a5114add420
                                                                                                                                                  • Instruction ID: 7da089473aa26f62989ef3f5f1587ebcdddf4086610b21ed715ad7d8ba768998
                                                                                                                                                  • Opcode Fuzzy Hash: 69550027ed8e3bf035e7bef6798a6f7658c1153be72ca181ca789a5114add420
                                                                                                                                                  • Instruction Fuzzy Hash: 95F04940B0D20B65FE587BE298542B4A2945FACB40FCC4435CA1F862D2FF2CF4826230
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BCC2C Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • RtlAllocateHeap.NTDLL(?,?,?,00007FF73D7AF1E4,?,?,?,00007FF73D7B06F6,?,?,?,?,?,00007FF73D7B275D), ref: 00007FF73D7BCC6A
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: AllocateHeap
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1279760036-0
                                                                                                                                                  • Opcode ID: b827a7ab023d1767f95784f6f7fefaf86c66ee15463514ccfd07e797832e7771
                                                                                                                                                  • Instruction ID: 46d808f0efd6a0ce807184155e0fcfa0990347bdde9abd32edbc7a856490e093
                                                                                                                                                  • Opcode Fuzzy Hash: b827a7ab023d1767f95784f6f7fefaf86c66ee15463514ccfd07e797832e7771
                                                                                                                                                  • Instruction Fuzzy Hash: ADF05E50B1D24E65FE2576F1594567591809FBD7A0FC88236E92E4A2D1FF2CB440B230
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7A6490 Relevance: 1.3, APIs: 1, Instructions: 92COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: DirectoryErrorLastRemove
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 377330604-0
                                                                                                                                                  • Opcode ID: 084d7b594bcd28fb49fbeb931c26155fa6ca1cda91761dc2622677426efca5d5
                                                                                                                                                  • Instruction ID: 3c4cc2dcf7dd0f2f2eb5a4e0e995daf7d0a30351eb2fdc83f3ee6199536cc9fc
                                                                                                                                                  • Opcode Fuzzy Hash: 084d7b594bcd28fb49fbeb931c26155fa6ca1cda91761dc2622677426efca5d5
                                                                                                                                                  • Instruction Fuzzy Hash: CB417856D1CBC991EA61AB64D5022BC6360FBA9744F849232DF8D42257FF28F6C8D720
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Non-executed Functions

                                                                                                                                                  Function 00007FF73D7A2F20 Relevance: 291.0, APIs: 55, Strings: 111, Instructions: 457libraryloaderCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,00000000,00007FF73D7A22DE,?,?,?,?), ref: 00007FF73D7A2F36
                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,00000000,00007FF73D7A22DE,?,?,?,?), ref: 00007FF73D7A2F75
                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,00000000,00007FF73D7A22DE,?,?,?,?), ref: 00007FF73D7A2F9A
                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,00000000,00007FF73D7A22DE,?,?,?,?), ref: 00007FF73D7A2FBF
                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,00000000,00007FF73D7A22DE,?,?,?,?), ref: 00007FF73D7A2FE7
                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,00000000,00007FF73D7A22DE,?,?,?,?), ref: 00007FF73D7A300F
                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,00000000,00007FF73D7A22DE,?,?,?,?), ref: 00007FF73D7A3037
                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,00000000,00007FF73D7A22DE,?,?,?,?), ref: 00007FF73D7A305F
                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,00000000,00007FF73D7A22DE,?,?,?,?), ref: 00007FF73D7A3087
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: AddressProc
                                                                                                                                                  • String ID: Failed to get address for PyDict_GetItemString$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyList_New$Failed to get address for PyLong_AsLong$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PySys_AddWarnOption$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetArgvEx$Failed to get address for PySys_SetObject$Failed to get address for PySys_SetPath$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_BuildValue$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_DontWriteBytecodeFlag$Failed to get address for Py_FileSystemDefaultEncoding$Failed to get address for Py_Finalize$Failed to get address for Py_FrozenFlag$Failed to get address for Py_GetPath$Failed to get address for Py_IgnoreEnvironmentFlag$Failed to get address for Py_IncRef$Failed to get address for Py_Initialize$Failed to get address for Py_NoSiteFlag$Failed to get address for Py_NoUserSiteDirectory$Failed to get address for Py_OptimizeFlag$Failed to get address for Py_SetPath$Failed to get address for Py_SetProgramName$Failed to get address for Py_SetPythonHome$Failed to get address for Py_UTF8Mode$Failed to get address for Py_UnbufferedStdioFlag$Failed to get address for Py_VerboseFlag$GetProcAddress$PyDict_GetItemString$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyList_New$PyLong_AsLong$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyRun_SimpleStringFlags$PySys_AddWarnOption$PySys_GetObject$PySys_SetArgvEx$PySys_SetObject$PySys_SetPath$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_BuildValue$Py_DecRef$Py_DecodeLocale$Py_DontWriteBytecodeFlag$Py_FileSystemDefaultEncoding$Py_Finalize$Py_FrozenFlag$Py_GetPath$Py_IgnoreEnvironmentFlag$Py_IncRef$Py_Initialize$Py_NoSiteFlag$Py_NoUserSiteDirectory$Py_OptimizeFlag$Py_SetPath$Py_SetProgramName$Py_SetPythonHome$Py_UTF8Mode$Py_UnbufferedStdioFlag$Py_VerboseFlag
                                                                                                                                                  • API String ID: 190572456-3109299426
                                                                                                                                                  • Opcode ID: 3d8788b48c699204fb620db4b6681a167f3e5177f9efbc96361098fa63709e71
                                                                                                                                                  • Instruction ID: 90c808ff90b4c3480468f1f815a2a847eb6a26a471bad97f6f0923529f9b8812
                                                                                                                                                  • Opcode Fuzzy Hash: 3d8788b48c699204fb620db4b6681a167f3e5177f9efbc96361098fa63709e71
                                                                                                                                                  • Instruction Fuzzy Hash: D5428465E4DB0BF5EA15BB84A858174A3A1BF0C7A1BD46035D88E06364FF7CF558B320
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7C324C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
                                                                                                                                                  • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                                                                                                  • API String ID: 808467561-2761157908
                                                                                                                                                  • Opcode ID: 94a7ddbc9dfde8fb095d9bbce1265888f255539b2e0e0fd568165e141f3b5970
                                                                                                                                                  • Instruction ID: 1ea8d1f248eb50fd06ef3705ff02a7a1a1f0bf3b97b08d55304ee7c3aa4c4246
                                                                                                                                                  • Opcode Fuzzy Hash: 94a7ddbc9dfde8fb095d9bbce1265888f255539b2e0e0fd568165e141f3b5970
                                                                                                                                                  • Instruction Fuzzy Hash: 0FB2F472E1C28A9FE7249FB4D4807FDB7A1FB58358F801135DA4E57A84EB38B9009B50
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7A6670 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetLastError.KERNEL32(WideCharToMultiByte,00007FF73D7A1CE4,?,?,00000000,00007FF73D7A6904), ref: 00007FF73D7A6697
                                                                                                                                                  • FormatMessageW.KERNEL32 ref: 00007FF73D7A66C6
                                                                                                                                                  • WideCharToMultiByte.KERNEL32 ref: 00007FF73D7A671C
                                                                                                                                                    • Part of subcall function 00007FF73D7A1CB0: GetLastError.KERNEL32(?,?,00000000,00007FF73D7A6904,?,?,?,?,?,?,?,?,?,?,?,00007FF73D7A1023), ref: 00007FF73D7A1CD7
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ErrorLast$ByteCharFormatMessageMultiWide
                                                                                                                                                  • String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
                                                                                                                                                  • API String ID: 2383786077-2573406579
                                                                                                                                                  • Opcode ID: ee4750cad08e904e569e44cd6da303e01fcfffc44399732fd87d74f29f2688a4
                                                                                                                                                  • Instruction ID: 815852d30fee7c1ce0e64ec1f14ac4bb5f39a45abcdd9b419e6c79d16d07df21
                                                                                                                                                  • Opcode Fuzzy Hash: ee4750cad08e904e569e44cd6da303e01fcfffc44399732fd87d74f29f2688a4
                                                                                                                                                  • Instruction Fuzzy Hash: 3C21AF31A1CA4AA5F760AB91E854269A365FB8C794FC40035E68D837A4FF3CF149A720
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7AAA2C Relevance: 10.6, APIs: 7, Instructions: 72COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3140674995-0
                                                                                                                                                  • Opcode ID: 414c3b7d1a52ef3ba5408d69683659119c26abb58edcf35ad0cee906abb0d3fb
                                                                                                                                                  • Instruction ID: e7732b1cae41157c743cfbfa39694a303825a54aaf0bdadc6f7f52e7c75e2d1c
                                                                                                                                                  • Opcode Fuzzy Hash: 414c3b7d1a52ef3ba5408d69683659119c26abb58edcf35ad0cee906abb0d3fb
                                                                                                                                                  • Instruction Fuzzy Hash: 28316572619B859AEB609FA0E8403EDB371FB48755F844039DA8D47794EF3CD548D720
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7B9C44 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1239891234-0
                                                                                                                                                  • Opcode ID: 5dfb057c3f1a11160ff10646ccc1b52b02cf652cbed9a545e94d4dbf2c44da7d
                                                                                                                                                  • Instruction ID: 8d5fe2a6a2ffee7f65fa2768026c1b19fb232a7a0287faf5c1036e09091e0012
                                                                                                                                                  • Opcode Fuzzy Hash: 5dfb057c3f1a11160ff10646ccc1b52b02cf652cbed9a545e94d4dbf2c44da7d
                                                                                                                                                  • Instruction Fuzzy Hash: FA31713261CF859AEB60DF65E8402AEB3A0FB88754F900136EA9D43B54EF3CE155CB10
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7C0A34 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: FileFindFirst_invalid_parameter_noinfo
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2227656907-0
                                                                                                                                                  • Opcode ID: ced153bd746da3696451066ca553fc750e98195ae426049d21287c39b66479d4
                                                                                                                                                  • Instruction ID: e422c403e1153449071b0164cf84c024ec30c100d2f5e9a2eddfc1ba84884ca9
                                                                                                                                                  • Opcode Fuzzy Hash: ced153bd746da3696451066ca553fc750e98195ae426049d21287c39b66479d4
                                                                                                                                                  • Instruction Fuzzy Hash: 4EB1C762B1C69A59EA61EBA198001B9E350EB58BF4FC44132E99E07BC5FF3CF451D360
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7C2DB0 Relevance: 4.8, APIs: 3, Instructions: 340COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: memcpy_s
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1502251526-0
                                                                                                                                                  • Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                                                                                                                                  • Instruction ID: 43cd5730d9a8954ba8238ec136207929c6e7a99a34cb1e75ce94cd4eab3750f9
                                                                                                                                                  • Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                                                                                                                                  • Instruction Fuzzy Hash: 74C11772B1C68A9BDB24DF99A08466AF791F788794F848134DB8E47744EB3DF901CB00
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7C8BE8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ExceptionRaise_clrfp
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 15204871-0
                                                                                                                                                  • Opcode ID: ce95b3d84f14f29cd4e01f3d624d654ffebb0793079cdf733c9da6505e2ad06c
                                                                                                                                                  • Instruction ID: 46cd08b2e7ee44c7ff4738e987e0fb23a4896eadea6b3e87265d8dfe5a38135d
                                                                                                                                                  • Opcode Fuzzy Hash: ce95b3d84f14f29cd4e01f3d624d654ffebb0793079cdf733c9da6505e2ad06c
                                                                                                                                                  • Instruction Fuzzy Hash: 78B19073604B898FEB19CF29C84636C7BA0F748B58F588926DB9D837A4DB39E451C710
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7B2A18 Relevance: 2.8, Strings: 2, Instructions: 350COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID: $
                                                                                                                                                  • API String ID: 0-227171996
                                                                                                                                                  • Opcode ID: 12f3629fc0db3b94ce06ee7fe38b00bcc3d57b8cb20d1c91e47922b02d0d68b8
                                                                                                                                                  • Instruction ID: fd13e525db35af91fb0faeca940f922e50841849329600219ccbf2da797c58bc
                                                                                                                                                  • Opcode Fuzzy Hash: 12f3629fc0db3b94ce06ee7fe38b00bcc3d57b8cb20d1c91e47922b02d0d68b8
                                                                                                                                                  • Instruction Fuzzy Hash: A6E1D93290E64AA5EB68AE65805013DB360FF6DB44F944235DE0E07794FF39FA41E7A0
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BD1F8 Relevance: 2.6, Strings: 2, Instructions: 144COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID: e+000$gfff
                                                                                                                                                  • API String ID: 0-3030954782
                                                                                                                                                  • Opcode ID: 7f3e0c3824b7b5cf876389fd48d0d53d421d0873473af5a4edca9f3cc5d4c2f0
                                                                                                                                                  • Instruction ID: e5c874fcc5136e2780c5be06b1e889f33ec4bae70f03715e3113170368b2e6c6
                                                                                                                                                  • Opcode Fuzzy Hash: 7f3e0c3824b7b5cf876389fd48d0d53d421d0873473af5a4edca9f3cc5d4c2f0
                                                                                                                                                  • Instruction Fuzzy Hash: 4A517962B1C6C996E7249E7598017A9FB91E758B94F888231CBA947BC2EF3DF4408710
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BFA88 Relevance: 2.0, APIs: 1, Instructions: 461COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CurrentFeaturePresentProcessProcessor
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1010374628-0
                                                                                                                                                  • Opcode ID: 90772d11546bffc87ec7dfde7d1a2d7ae8b41f9ab35fc0f4eec901e51838d0bc
                                                                                                                                                  • Instruction ID: d8a5d7eddbcb5fe60504af8cafe3e5245538a6831d315d5180d491ad847b657a
                                                                                                                                                  • Opcode Fuzzy Hash: 90772d11546bffc87ec7dfde7d1a2d7ae8b41f9ab35fc0f4eec901e51838d0bc
                                                                                                                                                  • Instruction Fuzzy Hash: BB02B021A0D64A64EA65BBE19450279E690AF2DFA0FC44635ED6D473D2FF3DF402A330
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BCD64 Relevance: 1.5, Strings: 1, Instructions: 254COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID: gfffffff
                                                                                                                                                  • API String ID: 0-1523873471
                                                                                                                                                  • Opcode ID: 7cb6c3f32e91a926ccbf64ab8ba01f2a38c928c6639247976dccb01524fe6e1b
                                                                                                                                                  • Instruction ID: 714e84b6a452606a3b701c1a8b19f6254c171ea7a6a9744a00f024cc0b40c6e9
                                                                                                                                                  • Opcode Fuzzy Hash: 7cb6c3f32e91a926ccbf64ab8ba01f2a38c928c6639247976dccb01524fe6e1b
                                                                                                                                                  • Instruction Fuzzy Hash: 1AA13963B0C7CA56EB21DB6590107A9BB91EB68784F848032EE8D47785EB3DE502D711
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7B70FC Relevance: 1.4, Strings: 1, Instructions: 177COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                  • String ID: TMP
                                                                                                                                                  • API String ID: 3215553584-3125297090
                                                                                                                                                  • Opcode ID: 549cbbde4d05edb679bd0e1e8d8321e2e2e00e2b49b4b0b32e90adc79d383972
                                                                                                                                                  • Instruction ID: 5f34fbcb2c62fd6d87ed953a5462222620c65e3f903d02e2abfb4737eb06cc8c
                                                                                                                                                  • Opcode Fuzzy Hash: 549cbbde4d05edb679bd0e1e8d8321e2e2e00e2b49b4b0b32e90adc79d383972
                                                                                                                                                  • Instruction Fuzzy Hash: 14518111B0C34E61FA64BBA659112FAD291AFA9B94FC85434EE0E477D5FF3CF4126220
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7C2620 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: HeapProcess
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 54951025-0
                                                                                                                                                  • Opcode ID: 5644672d7aec8b178d5bd48a95ace976e45fdc56d1edf0a539dccc581205543b
                                                                                                                                                  • Instruction ID: d899b643be6861f34c4c1ac216a64c091bb9b9b0b0629f5dc2e9508a4037ef48
                                                                                                                                                  • Opcode Fuzzy Hash: 5644672d7aec8b178d5bd48a95ace976e45fdc56d1edf0a539dccc581205543b
                                                                                                                                                  • Instruction Fuzzy Hash: 1DB09220E0BB0AD6EA083BA1AC8661462A87F4CB21FC80138C44C41320EF3C30AA6720
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7B21DC Relevance: .4, Instructions: 351COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID:
                                                                                                                                                  • Opcode ID: 7d7d821e27f440e8d5d3622ff09e7c05bc36f3fd6b9038f787498be69d76432a
                                                                                                                                                  • Instruction ID: de8bffc2e34ef4bad312a23d377026aac85bcaf323ee1ad61d8fd3224f0aca10
                                                                                                                                                  • Opcode Fuzzy Hash: 7d7d821e27f440e8d5d3622ff09e7c05bc36f3fd6b9038f787498be69d76432a
                                                                                                                                                  • Instruction Fuzzy Hash: 4CE11A32A0D60AA5E764AAA8C45537CA791EF6D748F944231CE0D477D4EF3CFA41E3A0
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7B2614 Relevance: .3, Instructions: 327COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID:
                                                                                                                                                  • Opcode ID: c2f3b43ccd68eb767627d2655b116bae7479589a7f74a5058ab0c91b2e39ac12
                                                                                                                                                  • Instruction ID: 23725bda6bf221e139bccec3cb9083219aac272bc75f6d62afa7dff434aeb443
                                                                                                                                                  • Opcode Fuzzy Hash: c2f3b43ccd68eb767627d2655b116bae7479589a7f74a5058ab0c91b2e39ac12
                                                                                                                                                  • Instruction Fuzzy Hash: 97D11E3290D64A95EB68AE65801427DA3A0FF2DB48F940135CE0D477D4EF3DFA41E7A0
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7A7420 Relevance: .3, Instructions: 287COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID:
                                                                                                                                                  • Opcode ID: b723f182358e09e7314f6f73ac964ac7abcdc7414507ad18988289416ad7b41b
                                                                                                                                                  • Instruction ID: 6255bb5e9902b99eb5a5fa982a0266a03a76a84dd552ef3f83097fc0ec398b51
                                                                                                                                                  • Opcode Fuzzy Hash: b723f182358e09e7314f6f73ac964ac7abcdc7414507ad18988289416ad7b41b
                                                                                                                                                  • Instruction Fuzzy Hash: 24C1A6722241F04BE689EB29F4598BA77D2F788309FD9403AEB8747785CA3DE414D760
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7B132C Relevance: .2, Instructions: 250COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID:
                                                                                                                                                  • Opcode ID: 6c5c392cbfffe41992f0743bc4a0c2c3fe46246456b6811ff0c5dafdd99ec142
                                                                                                                                                  • Instruction ID: eebc66a7a58ad6806ff5908c5336ab0443813bdcdac888f90976cddf387395b8
                                                                                                                                                  • Opcode Fuzzy Hash: 6c5c392cbfffe41992f0743bc4a0c2c3fe46246456b6811ff0c5dafdd99ec142
                                                                                                                                                  • Instruction Fuzzy Hash: 4DB1D172A0C64999E7649F79C05023DBBA0EB29B48F580135CE4F43399EF39F844E761
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7B16C4 Relevance: .2, Instructions: 241COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID:
                                                                                                                                                  • Opcode ID: 85060b88648c64536cd03416e20448513b0a4375a109c0566769b76d71526d0c
                                                                                                                                                  • Instruction ID: 521758934ad47704c5a47856ac1bdadc4c9993db2de10eeff9971e4ed9d6b767
                                                                                                                                                  • Opcode Fuzzy Hash: 85060b88648c64536cd03416e20448513b0a4375a109c0566769b76d71526d0c
                                                                                                                                                  • Instruction Fuzzy Hash: BEB1BD72A0CA9995E7649F79C05023CBBA4F729B48FA40135CE4F43394EF39E449E760
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BD878 Relevance: .2, Instructions: 198COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID:
                                                                                                                                                  • Opcode ID: 59ad0bfc87d4107bda453f5e7c9a116e1e97c6e992cf3a610b4e267b4cffcaca
                                                                                                                                                  • Instruction ID: 7da0af42b86e13b91ac1f7d943a3d036721ff7de027c255246e11ecf2f1da8a9
                                                                                                                                                  • Opcode Fuzzy Hash: 59ad0bfc87d4107bda453f5e7c9a116e1e97c6e992cf3a610b4e267b4cffcaca
                                                                                                                                                  • Instruction Fuzzy Hash: 8B811472A0C78596EB74DB59944037AFAA0FB59794F844235DA8E43B89EF3CF4009B10
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7C58A0 Relevance: .2, Instructions: 183COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                  • Opcode ID: 2033a98ce9b9ae1b6fcbd26cbe8033cb2e42881aa268c02d842b0e820a1bc4f5
                                                                                                                                                  • Instruction ID: 67bc2a7f38c967f6289de2948b5196797a70629b45e194b0378688e574e6d47a
                                                                                                                                                  • Opcode Fuzzy Hash: 2033a98ce9b9ae1b6fcbd26cbe8033cb2e42881aa268c02d842b0e820a1bc4f5
                                                                                                                                                  • Instruction Fuzzy Hash: 81613E22E1C2865DF764A5AA848023DE990AF487B0FD40335DA9E476C5FF7EF800A720
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7AFF44 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID:
                                                                                                                                                  • Opcode ID: 9a7d583fdacf7a8c68166448a21aae8e03012e85621840fd7aae1b2904462282
                                                                                                                                                  • Instruction ID: 74ab4e14a69192871eec1afbc14abf69a86ea19153857dba031226d0fa21506a
                                                                                                                                                  • Opcode Fuzzy Hash: 9a7d583fdacf7a8c68166448a21aae8e03012e85621840fd7aae1b2904462282
                                                                                                                                                  • Instruction Fuzzy Hash: 4A51C332A1C65992E7249F68C04023CB3A0EB5EB68FA44131DE8C17794EB3AF853E750
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7B0764 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID:
                                                                                                                                                  • Opcode ID: e009b45869f76b4bc0fd62373217406c0429eee7efa8b33e1f678da67ddd1256
                                                                                                                                                  • Instruction ID: 2e9d0111666f7d3993168fc52eb78791309a18a37cf2ddb3794125636feb957e
                                                                                                                                                  • Opcode Fuzzy Hash: e009b45869f76b4bc0fd62373217406c0429eee7efa8b33e1f678da67ddd1256
                                                                                                                                                  • Instruction Fuzzy Hash: EC51B936A1CA5595E7249B69C04023CB7A0FB6EF68F644131CE4C07795EB3AF863D790
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7B0354 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID:
                                                                                                                                                  • Opcode ID: 4e0632a4a7e014686f42235b66fbebb9a54d6c0d44d943c89546efb0de6bc1d6
                                                                                                                                                  • Instruction ID: 3d048f58744fbf2aa5668a0b8ff7e6e3d79621727627cc707dbd25e9c174f422
                                                                                                                                                  • Opcode Fuzzy Hash: 4e0632a4a7e014686f42235b66fbebb9a54d6c0d44d943c89546efb0de6bc1d6
                                                                                                                                                  • Instruction Fuzzy Hash: C551E632A1C65996E7349B68C04423CB3A0EB6EB68F644235CE4C17795EF3AF863D750
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7AFD40 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID:
                                                                                                                                                  • Opcode ID: 1122cbedd3da6cae4974dcedcaf2c480ad91f4dcca857e3bd784bf5366bd6c74
                                                                                                                                                  • Instruction ID: 0fa81b17e446d2f5f805f0b186151e164659322a2ebac6dbda6fb2efd4170efc
                                                                                                                                                  • Opcode Fuzzy Hash: 1122cbedd3da6cae4974dcedcaf2c480ad91f4dcca857e3bd784bf5366bd6c74
                                                                                                                                                  • Instruction Fuzzy Hash: 1751BD32A1C65996E7259B69C050328E3A0EF4DB58FA44135EA4C07795EB3AFC43E790
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7B0560 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID:
                                                                                                                                                  • Opcode ID: bbc3e59ea296ef31dc5cb467e3ef236485a99d13d7a42ba6bd49c72ea64a61b5
                                                                                                                                                  • Instruction ID: a1bcb30f65267937021a765d511bf4429a4e28f34dfdbf07cfb678141cc83959
                                                                                                                                                  • Opcode Fuzzy Hash: bbc3e59ea296ef31dc5cb467e3ef236485a99d13d7a42ba6bd49c72ea64a61b5
                                                                                                                                                  • Instruction Fuzzy Hash: 1D511532A1C6599AE7249B28C04163CB3A0EBAEB58F644131CE4D17794EF3AFC63D750
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7B0150 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID:
                                                                                                                                                  • Opcode ID: e8fed526c0ef6e22bd960d06d2221fad266d41c34a47db8c9ca14c01ed2528e2
                                                                                                                                                  • Instruction ID: 8f90ba71eaa20ecded08809eb69d9cb626c0c5b98aa43178bf6f9c68719ddc63
                                                                                                                                                  • Opcode Fuzzy Hash: e8fed526c0ef6e22bd960d06d2221fad266d41c34a47db8c9ca14c01ed2528e2
                                                                                                                                                  • Instruction Fuzzy Hash: 9151E632A1C65996E7349B68C04033CA3A1EB6EB58F645031DE4D07798EF3AF863D750
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7B4FC0 Relevance: .1, Instructions: 138COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID:
                                                                                                                                                  • Opcode ID: 7e13b74b0b529d91a8ac9ee6727b9f2d590474870fceb05c3e17ea5803dfc50d
                                                                                                                                                  • Instruction ID: 247b5d2d16b2076b9d41f9e8d1c68dcdadb66c12f7c8d61b7b5c6de9a758dc59
                                                                                                                                                  • Opcode Fuzzy Hash: 7e13b74b0b529d91a8ac9ee6727b9f2d590474870fceb05c3e17ea5803dfc50d
                                                                                                                                                  • Instruction Fuzzy Hash: 1341F552C4D64E14E99599A805106B8A680DF3ABE4FD872B0DDD9133CBFF2C7587E120
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7B8D00 Relevance: .1, Instructions: 126COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ErrorLanguagesLastPreferredRestoreThread
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 588628887-0
                                                                                                                                                  • Opcode ID: 71af8a295fdb51eaf04f4fd3d3cb7b5e4e2b88d375af3dc160b99af84fd8c420
                                                                                                                                                  • Instruction ID: 58192acba40b3fec8aac858dfe65df9057cffe0258b675c2e43ccb2a72c827b5
                                                                                                                                                  • Opcode Fuzzy Hash: 71af8a295fdb51eaf04f4fd3d3cb7b5e4e2b88d375af3dc160b99af84fd8c420
                                                                                                                                                  • Instruction Fuzzy Hash: F8412862B18B5891EF08DF6AD924169B391BB5CFD0B899036DE0D87B54FF3CE1429310
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7B66C4 Relevance: .1, Instructions: 98COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID:
                                                                                                                                                  • Opcode ID: 5e61c3cf97b3866f04581c18cefd4280f5be6d0443f14e9e71bfe5dd080d96d4
                                                                                                                                                  • Instruction ID: 7c34f52565fe6e814bdc0f3b21af2eeba122b763d3a4d9c15c143586f991f9ba
                                                                                                                                                  • Opcode Fuzzy Hash: 5e61c3cf97b3866f04581c18cefd4280f5be6d0443f14e9e71bfe5dd080d96d4
                                                                                                                                                  • Instruction Fuzzy Hash: 5E31E73270CB4652EB24AFA5A84013DE6D4EB98BA0F944238EB9D57BD5EF3CE0025714
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7C8A30 Relevance: .0, Instructions: 32COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID:
                                                                                                                                                  • Opcode ID: 0a7304cda62ef4e3fce1e8e531a8e9660a3231e70ec23179b9d25e44c0445acc
                                                                                                                                                  • Instruction ID: 97182354610128ee90b284fe8495e5754a4a1d149dc3886e65ee9197172a53f8
                                                                                                                                                  • Opcode Fuzzy Hash: 0a7304cda62ef4e3fce1e8e531a8e9660a3231e70ec23179b9d25e44c0445acc
                                                                                                                                                  • Instruction Fuzzy Hash: FEF0687171C2569ADB989FA9A80266977D0F70C3C0F848039D68D83B04D73D90509F24
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7AABD4 Relevance: .0, Instructions: 2COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID:
                                                                                                                                                  • Opcode ID: 53f093bed3a5d0e4e42a94d80c7232e3ca8df1b9ab80f13d9c22a8443e6849f1
                                                                                                                                                  • Instruction ID: e7837adeea9996662b4e60e02ee3fa40b9a74f3996537825e3cb90f803550618
                                                                                                                                                  • Opcode Fuzzy Hash: 53f093bed3a5d0e4e42a94d80c7232e3ca8df1b9ab80f13d9c22a8443e6849f1
                                                                                                                                                  • Instruction Fuzzy Hash: 2DA0012690C84BE9E684AB80A860024A231BB58311B840232D08D421A0FF2CF840A360
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7A4730 Relevance: 166.5, APIs: 31, Strings: 64, Instructions: 287libraryloaderCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: AddressProc$LibraryLoad
                                                                                                                                                  • String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$LOADER: Failed to load tcl/tk libraries$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                                                                                                  • API String ID: 2238633743-1453502826
                                                                                                                                                  • Opcode ID: 387b05963c1573a630a89e02a7d3e5c8a0eed87054fdcdadb8995d5c72bb8a89
                                                                                                                                                  • Instruction ID: 8f2293016b732da2165b862d60a6b8d4acf9c2fbfcbe97595a3fbeb737544673
                                                                                                                                                  • Opcode Fuzzy Hash: 387b05963c1573a630a89e02a7d3e5c8a0eed87054fdcdadb8995d5c72bb8a89
                                                                                                                                                  • Instruction Fuzzy Hash: 6EE1A364A0DB0BB4FA15BB94A854174A3A5BF0CBA1BD45035D88E06368FF7CF588B360
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7A6BF0 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 113COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • MultiByteToWideChar.KERNEL32 ref: 00007FF73D7A6C2C
                                                                                                                                                    • Part of subcall function 00007FF73D7A1CB0: GetLastError.KERNEL32(?,?,00000000,00007FF73D7A6904,?,?,?,?,?,?,?,?,?,?,?,00007FF73D7A1023), ref: 00007FF73D7A1CD7
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ByteCharErrorLastMultiWide
                                                                                                                                                  • String ID: Failed to decode wchar_t from UTF-8$Failed to encode filename as ANSI.$Failed to get ANSI buffer size.$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$WideCharToMultiByte$win32_utils_from_utf8$win32_wcs_to_mbs
                                                                                                                                                  • API String ID: 203985260-1562484376
                                                                                                                                                  • Opcode ID: 3649c6f93bb09270b823ff22ec7b0eec6d42e79460650eefbf3c7b929506c9f8
                                                                                                                                                  • Instruction ID: ce4bbda8309154f9ac2cfb1749fd0945ef60caa6e6a92a622fe2b4ec31b290bc
                                                                                                                                                  • Opcode Fuzzy Hash: 3649c6f93bb09270b823ff22ec7b0eec6d42e79460650eefbf3c7b929506c9f8
                                                                                                                                                  • Instruction Fuzzy Hash: 64417661A0CA4A65EA20FBA1A84007AE6A1AF5CBD4FD44135E94D47B95FF3CF145A320
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7AF5C8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                  • String ID: f$f$p$p$f
                                                                                                                                                  • API String ID: 3215553584-1325933183
                                                                                                                                                  • Opcode ID: 5b8d5396a44c552a0cc4e48ad8092be8cf806d396b8c8f6251230df5f0eb9214
                                                                                                                                                  • Instruction ID: 01c71594f1727119d9f81ba734688642d85b0da97f00d24c037ed876a9967557
                                                                                                                                                  • Opcode Fuzzy Hash: 5b8d5396a44c552a0cc4e48ad8092be8cf806d396b8c8f6251230df5f0eb9214
                                                                                                                                                  • Instruction Fuzzy Hash: 4E12A622E0C14BA5FB60BA95D0546BAF261FF88754FD44032F699467C4EF3CF482AB21
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7A12B0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 106COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                  • API String ID: 0-3659356012
                                                                                                                                                  • Opcode ID: 27849c73a2b453c9c71bd8b325d1811199276ab163fc5dd860d9c84c8935c1af
                                                                                                                                                  • Instruction ID: 9727606b3beef95fbd1a7b1725d76c9eeacb80fa0a0033cfc6dc678c7798cf55
                                                                                                                                                  • Opcode Fuzzy Hash: 27849c73a2b453c9c71bd8b325d1811199276ab163fc5dd860d9c84c8935c1af
                                                                                                                                                  • Instruction Fuzzy Hash: 9A417F22B0CA4BA5FA14EB95A4002A9E3A0FB587D4FC54432DE4D47B45FF3CF545A320
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7ACF90 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                                                                                                  • String ID: csm$csm$csm
                                                                                                                                                  • API String ID: 849930591-393685449
                                                                                                                                                  • Opcode ID: c9717f7599358984fa081211ebe6d8e8a7f2fe77f13a54a703b9fcdffbee59eb
                                                                                                                                                  • Instruction ID: e2d5e961043de3c1a812f6620843a655433bc26196b0d968643a396a0d47f3aa
                                                                                                                                                  • Opcode Fuzzy Hash: c9717f7599358984fa081211ebe6d8e8a7f2fe77f13a54a703b9fcdffbee59eb
                                                                                                                                                  • Instruction Fuzzy Hash: 6BE18272A0C749A6EB20ABA5D4403ADB7A0FB48798F904135EE8D57B95FF38F481D710
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7A67C0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 103COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF73D7A1023), ref: 00007FF73D7A685F
                                                                                                                                                  • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF73D7A1023), ref: 00007FF73D7A68AF
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ByteCharMultiWide
                                                                                                                                                  • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                                                                                                                                  • API String ID: 626452242-27947307
                                                                                                                                                  • Opcode ID: 8d77172852237fffccb974c6d54fb7d37946d1ed41806d5f964de7f541550d5e
                                                                                                                                                  • Instruction ID: 4339a73eb9ec222c11867c4f7d6b40c6e65aab0f9a0fc61970465268fcf742ed
                                                                                                                                                  • Opcode Fuzzy Hash: 8d77172852237fffccb974c6d54fb7d37946d1ed41806d5f964de7f541550d5e
                                                                                                                                                  • Instruction Fuzzy Hash: C541C532A0CF8695E620EF91B840169F7A4FB98B94F944135DA8D47B94FF3CE055D710
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7A6EC0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • WideCharToMultiByte.KERNEL32(00000000,00007FF73D7A2D35,?,?,?,?,?,?), ref: 00007FF73D7A6F01
                                                                                                                                                    • Part of subcall function 00007FF73D7A1CB0: GetLastError.KERNEL32(?,?,00000000,00007FF73D7A6904,?,?,?,?,?,?,?,?,?,?,?,00007FF73D7A1023), ref: 00007FF73D7A1CD7
                                                                                                                                                  • WideCharToMultiByte.KERNEL32(00000000,00007FF73D7A2D35,?,?,?,?,?,?), ref: 00007FF73D7A6F75
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ByteCharMultiWide$ErrorLast
                                                                                                                                                  • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                                                                                                                                  • API String ID: 1717984340-27947307
                                                                                                                                                  • Opcode ID: d869b65ad41923ea885775a182ffbbb4fa8a6a55f9429b012359a23964d7bd56
                                                                                                                                                  • Instruction ID: a9b3a82bb95362137b407c2e31af28b0b28ddb2d6347e2ea6eec56dc38ca71eb
                                                                                                                                                  • Opcode Fuzzy Hash: d869b65ad41923ea885775a182ffbbb4fa8a6a55f9429b012359a23964d7bd56
                                                                                                                                                  • Instruction Fuzzy Hash: 7E215E61A0CB4AA9E720EB96A840069F761BB88B90B944135EA4D437A4FF3CF555A310
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7B93C4 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                  • String ID: f$p$p
                                                                                                                                                  • API String ID: 3215553584-1995029353
                                                                                                                                                  • Opcode ID: d478605e8072a694eb9a9d804e4987f1596106984b5661be3eee2fb972e34d58
                                                                                                                                                  • Instruction ID: da0d617228a30c9d7032741e0ac2749ba30ec24b02b45cb7c6d6aeb406e88bc1
                                                                                                                                                  • Opcode Fuzzy Hash: d478605e8072a694eb9a9d804e4987f1596106984b5661be3eee2fb972e34d58
                                                                                                                                                  • Instruction Fuzzy Hash: 2212D4A2E0C14BA6FB607A95D0542BAF691FBA8750FD44035D6A9476C4FF3CF580EB20
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7A6FB0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 98COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ByteCharMultiWide
                                                                                                                                                  • String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                                                                                                                                  • API String ID: 626452242-876015163
                                                                                                                                                  • Opcode ID: 9e091cbaac830d0070f3842cc1d5ec76c8d2d2f90cb19691d00490de1532936c
                                                                                                                                                  • Instruction ID: f1047944836d24e909ff2e6c70373b4811ace27e629284149685260dcc4371d1
                                                                                                                                                  • Opcode Fuzzy Hash: 9e091cbaac830d0070f3842cc1d5ec76c8d2d2f90cb19691d00490de1532936c
                                                                                                                                                  • Instruction Fuzzy Hash: B841D332A0CB5AA5E610EF55A84017AB6A5FB88B94FD40135EE8D47BA4FF3CF052D710
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7A55E0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 00007FF73D7A6DB0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?), ref: 00007FF73D7A6DEA
                                                                                                                                                  • ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF73D7A592F,?,00000000,?,TokenIntegrityLevel), ref: 00007FF73D7A563F
                                                                                                                                                  Strings
                                                                                                                                                  • LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF73D7A569A
                                                                                                                                                  • LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF73D7A5653
                                                                                                                                                  • LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF73D7A5616
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ByteCharEnvironmentExpandMultiStringsWide
                                                                                                                                                  • String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
                                                                                                                                                  • API String ID: 2001182103-3498232454
                                                                                                                                                  • Opcode ID: aa564683267f47d688a8517bb88a9b0a9054f6e1f4b3a9048b672f302df95511
                                                                                                                                                  • Instruction ID: 86a1dfbd161f058e244d01c0e900eeeead38b42a3519b2b64ba5da4a0335936d
                                                                                                                                                  • Opcode Fuzzy Hash: aa564683267f47d688a8517bb88a9b0a9054f6e1f4b3a9048b672f302df95511
                                                                                                                                                  • Instruction Fuzzy Hash: 7431A551B1C78AB0FA64B7A1D9152BAE2A1AF9C7D0FC44431DA4E43786FF2CF1049720
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7AC248 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • LoadLibraryExW.KERNEL32(?,?,?,00007FF73D7AC4FA,?,?,?,00007FF73D7AC1EC,?,?,00000001,00007FF73D7ABE09), ref: 00007FF73D7AC2CD
                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,00007FF73D7AC4FA,?,?,?,00007FF73D7AC1EC,?,?,00000001,00007FF73D7ABE09), ref: 00007FF73D7AC2DB
                                                                                                                                                  • LoadLibraryExW.KERNEL32(?,?,?,00007FF73D7AC4FA,?,?,?,00007FF73D7AC1EC,?,?,00000001,00007FF73D7ABE09), ref: 00007FF73D7AC305
                                                                                                                                                  • FreeLibrary.KERNEL32(?,?,?,00007FF73D7AC4FA,?,?,?,00007FF73D7AC1EC,?,?,00000001,00007FF73D7ABE09), ref: 00007FF73D7AC34B
                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,?,00007FF73D7AC4FA,?,?,?,00007FF73D7AC1EC,?,?,00000001,00007FF73D7ABE09), ref: 00007FF73D7AC357
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                                                  • String ID: api-ms-
                                                                                                                                                  • API String ID: 2559590344-2084034818
                                                                                                                                                  • Opcode ID: 9ce77a0163c425c367fd7c26c9c82fe5a817cd2dfec158d19dd861a4531b58f3
                                                                                                                                                  • Instruction ID: 694132b2ef6b5575094d74aa604baf6f8deadee6b696ef2ffab5625fe4e60659
                                                                                                                                                  • Opcode Fuzzy Hash: 9ce77a0163c425c367fd7c26c9c82fe5a817cd2dfec158d19dd861a4531b58f3
                                                                                                                                                  • Instruction Fuzzy Hash: D231B225A0E64AB5EE51AB8AA800579A394FF0DBA0FD90535EE1D47384FF3CF0449721
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7A6DB0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • MultiByteToWideChar.KERNEL32(?,?,?,?,?,?), ref: 00007FF73D7A6DEA
                                                                                                                                                    • Part of subcall function 00007FF73D7A1CB0: GetLastError.KERNEL32(?,?,00000000,00007FF73D7A6904,?,?,?,?,?,?,?,?,?,?,?,00007FF73D7A1023), ref: 00007FF73D7A1CD7
                                                                                                                                                  • MultiByteToWideChar.KERNEL32(?,?,?,?,?,?), ref: 00007FF73D7A6E70
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ByteCharMultiWide$ErrorLast
                                                                                                                                                  • String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                                                                                                                                  • API String ID: 1717984340-876015163
                                                                                                                                                  • Opcode ID: 7f54e5da8ee4cb54e1cd0e604769d215f15cea2374718bc11fd99751b49c0007
                                                                                                                                                  • Instruction ID: ee1cb64ad129ad52a4548dd5ef0f8c2aaf98b9f327f118b63453657b6b6e1ab7
                                                                                                                                                  • Opcode Fuzzy Hash: 7f54e5da8ee4cb54e1cd0e604769d215f15cea2374718bc11fd99751b49c0007
                                                                                                                                                  • Instruction Fuzzy Hash: 66218521B0CA4661EB10EB69F800169E761FB8DBD4F984135DB4C83B69FF2CF5919710
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BA780 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,00007FF73D7C24B3,?,?,?,00007FF73D7BCCEC,?,?,00000000,00007FF73D7B386F,?,?,?,00007FF73D7B9473), ref: 00007FF73D7BA78F
                                                                                                                                                  • FlsGetValue.KERNEL32(?,?,?,00007FF73D7C24B3,?,?,?,00007FF73D7BCCEC,?,?,00000000,00007FF73D7B386F,?,?,?,00007FF73D7B9473), ref: 00007FF73D7BA7A4
                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF73D7C24B3,?,?,?,00007FF73D7BCCEC,?,?,00000000,00007FF73D7B386F,?,?,?,00007FF73D7B9473), ref: 00007FF73D7BA7C5
                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF73D7C24B3,?,?,?,00007FF73D7BCCEC,?,?,00000000,00007FF73D7B386F,?,?,?,00007FF73D7B9473), ref: 00007FF73D7BA7F2
                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF73D7C24B3,?,?,?,00007FF73D7BCCEC,?,?,00000000,00007FF73D7B386F,?,?,?,00007FF73D7B9473), ref: 00007FF73D7BA803
                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF73D7C24B3,?,?,?,00007FF73D7BCCEC,?,?,00000000,00007FF73D7B386F,?,?,?,00007FF73D7B9473), ref: 00007FF73D7BA814
                                                                                                                                                  • SetLastError.KERNEL32(?,?,?,00007FF73D7C24B3,?,?,?,00007FF73D7BCCEC,?,?,00000000,00007FF73D7B386F,?,?,?,00007FF73D7B9473), ref: 00007FF73D7BA82F
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Value$ErrorLast
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2506987500-0
                                                                                                                                                  • Opcode ID: 3971363800b8a81fa04bc153c76856abca93ecf9b7e0d768850358a078ef79bd
                                                                                                                                                  • Instruction ID: e65f284636d0e9b19f52ab4430d53f97887b3b3550bdb82e708ecf4ffafae41c
                                                                                                                                                  • Opcode Fuzzy Hash: 3971363800b8a81fa04bc153c76856abca93ecf9b7e0d768850358a078ef79bd
                                                                                                                                                  • Instruction Fuzzy Hash: 8C21FD20F0CA0A62FA6973E05955179EA52AF6C7B0FC40734E83E47BC6FF6CB4416220
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7C70EC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                                                  • String ID: CONOUT$
                                                                                                                                                  • API String ID: 3230265001-3130406586
                                                                                                                                                  • Opcode ID: 900c1da012dee1dfb60ea43974335527b3f6c3b56b4e810762f126343bdfd55c
                                                                                                                                                  • Instruction ID: 657aa8749b6e139b72acfed6228271fdb15503b1051557c232251e8b84308eda
                                                                                                                                                  • Opcode Fuzzy Hash: 900c1da012dee1dfb60ea43974335527b3f6c3b56b4e810762f126343bdfd55c
                                                                                                                                                  • Instruction Fuzzy Hash: B8119322B1CB459AE350AB92E854329A2A0FB8CBF5F840234DA9D87794EF7CE4449750
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BA8F8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,00007FF73D7B6091,?,?,?,?,00007FF73D7BDF1F,?,?,00000000,00007FF73D7BAA16,?,?,?), ref: 00007FF73D7BA907
                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF73D7B6091,?,?,?,?,00007FF73D7BDF1F,?,?,00000000,00007FF73D7BAA16,?,?,?), ref: 00007FF73D7BA93D
                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF73D7B6091,?,?,?,?,00007FF73D7BDF1F,?,?,00000000,00007FF73D7BAA16,?,?,?), ref: 00007FF73D7BA96A
                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF73D7B6091,?,?,?,?,00007FF73D7BDF1F,?,?,00000000,00007FF73D7BAA16,?,?,?), ref: 00007FF73D7BA97B
                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF73D7B6091,?,?,?,?,00007FF73D7BDF1F,?,?,00000000,00007FF73D7BAA16,?,?,?), ref: 00007FF73D7BA98C
                                                                                                                                                  • SetLastError.KERNEL32(?,?,?,00007FF73D7B6091,?,?,?,?,00007FF73D7BDF1F,?,?,00000000,00007FF73D7BAA16,?,?,?), ref: 00007FF73D7BA9A7
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Value$ErrorLast
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2506987500-0
                                                                                                                                                  • Opcode ID: 9c16369c9cedf713b6ac3dac2cb17ec2f8e610dc045da35baaf6277b530098a9
                                                                                                                                                  • Instruction ID: 576ff46cf3acc65a09dc9227a87b1c183b6a49bed6d44eda76a4e226ce5dc60e
                                                                                                                                                  • Opcode Fuzzy Hash: 9c16369c9cedf713b6ac3dac2cb17ec2f8e610dc045da35baaf6277b530098a9
                                                                                                                                                  • Instruction Fuzzy Hash: 5E11DE20B0C60A62FA5873E19995179E692AFAD7B0FC54734E87E437D6FF6CB4407220
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7ABC08 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                                                                                                  • String ID: csm$f
                                                                                                                                                  • API String ID: 2395640692-629598281
                                                                                                                                                  • Opcode ID: e4cc0f9b1589dd73a5d4f416534ce71b9b3e94dd2aede877d85d93aa73312820
                                                                                                                                                  • Instruction ID: 02df527b9b837b6ca96c77ce98d63b28de1ec998c874bf49164b388b2ba260a3
                                                                                                                                                  • Opcode Fuzzy Hash: e4cc0f9b1589dd73a5d4f416534ce71b9b3e94dd2aede877d85d93aa73312820
                                                                                                                                                  • Instruction Fuzzy Hash: 4E51C732A2D60AAAD715EF55E408A39B795FB48B88FD18134EA4E47748FF38F841D710
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7B8A40 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                  • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                  • API String ID: 4061214504-1276376045
                                                                                                                                                  • Opcode ID: 78a1a69aac29132cf000f84d0d5f993c26bceca4d1e4e1c3cfa2e89eec15c9a9
                                                                                                                                                  • Instruction ID: 3f764ba9dbf79d3a14a3b9682b419b2fc83fc32fcfa706dcc57adfeff000a78d
                                                                                                                                                  • Opcode Fuzzy Hash: 78a1a69aac29132cf000f84d0d5f993c26bceca4d1e4e1c3cfa2e89eec15c9a9
                                                                                                                                                  • Instruction Fuzzy Hash: C5F04461A0D70A51EA10AB94E8543399360BF4D7B1FD40635CAAD461E4FF2CE088E320
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7C8824 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _set_statfp
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1156100317-0
                                                                                                                                                  • Opcode ID: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
                                                                                                                                                  • Instruction ID: 8a387cb5287f0b2c8d14b08fd502ee7c0803bbeec9480428bbb9fea52dd92f38
                                                                                                                                                  • Opcode Fuzzy Hash: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
                                                                                                                                                  • Instruction Fuzzy Hash: DE118622D2CA2B29F6743194D45537591816F5D374F890634E9EE4BADBEF2CB8406120
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BA9C0 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • FlsGetValue.KERNEL32(?,?,?,00007FF73D7B9BD3,?,?,00000000,00007FF73D7B9E6E,?,?,?,?,?,00007FF73D7B1A40), ref: 00007FF73D7BA9DF
                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF73D7B9BD3,?,?,00000000,00007FF73D7B9E6E,?,?,?,?,?,00007FF73D7B1A40), ref: 00007FF73D7BA9FE
                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF73D7B9BD3,?,?,00000000,00007FF73D7B9E6E,?,?,?,?,?,00007FF73D7B1A40), ref: 00007FF73D7BAA26
                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF73D7B9BD3,?,?,00000000,00007FF73D7B9E6E,?,?,?,?,?,00007FF73D7B1A40), ref: 00007FF73D7BAA37
                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF73D7B9BD3,?,?,00000000,00007FF73D7B9E6E,?,?,?,?,?,00007FF73D7B1A40), ref: 00007FF73D7BAA48
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Value
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3702945584-0
                                                                                                                                                  • Opcode ID: ccee12417dd8fadd804cf4bca67e11b29a445d0494c9c7ede3eb61f72115d30b
                                                                                                                                                  • Instruction ID: 356adb156fbb5f7645a66488813e76133487a23e6b7052feb4a9ae86f8f117c6
                                                                                                                                                  • Opcode Fuzzy Hash: ccee12417dd8fadd804cf4bca67e11b29a445d0494c9c7ede3eb61f72115d30b
                                                                                                                                                  • Instruction Fuzzy Hash: 13116D21A0C60A61FA5873E55A91179E9426F6C7B0F844334E83E477C6FF6CF441A620
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BA854 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF73D7C24B3,?,?,?,00007FF73D7BCCEC,?,?,00000000,00007FF73D7B386F), ref: 00007FF73D7BA865
                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF73D7C24B3,?,?,?,00007FF73D7BCCEC,?,?,00000000,00007FF73D7B386F), ref: 00007FF73D7BA884
                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF73D7C24B3,?,?,?,00007FF73D7BCCEC,?,?,00000000,00007FF73D7B386F), ref: 00007FF73D7BA8AC
                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF73D7C24B3,?,?,?,00007FF73D7BCCEC,?,?,00000000,00007FF73D7B386F), ref: 00007FF73D7BA8BD
                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF73D7C24B3,?,?,?,00007FF73D7BCCEC,?,?,00000000,00007FF73D7B386F), ref: 00007FF73D7BA8CE
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Value
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3702945584-0
                                                                                                                                                  • Opcode ID: 353fa8bf1983d63c804749c76f5f6573fef8243f584448c2a0a10dd8cdf132d1
                                                                                                                                                  • Instruction ID: 8de3d1b6fed6f7159be658053c7715b00672cb8969b6e31aa2b758845f7f88fe
                                                                                                                                                  • Opcode Fuzzy Hash: 353fa8bf1983d63c804749c76f5f6573fef8243f584448c2a0a10dd8cdf132d1
                                                                                                                                                  • Instruction Fuzzy Hash: 70114810E0CA0F61F9AA72E148521B995426F6D370FC80B34E83E4ABC2FF6DB4427231
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BF218 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                  • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                                                                                                  • API String ID: 3215553584-1196891531
                                                                                                                                                  • Opcode ID: fa9c2c0b9e0b51f4f192ae3b8b8b95ed4a793ff286fdede4dba764f85164dfb1
                                                                                                                                                  • Instruction ID: 81ef92fa8475317c67566f1b768b365ca134620ff95cb475da37eaa53685e9d3
                                                                                                                                                  • Opcode Fuzzy Hash: fa9c2c0b9e0b51f4f192ae3b8b8b95ed4a793ff286fdede4dba764f85164dfb1
                                                                                                                                                  • Instruction Fuzzy Hash: F1819136D0C20AA5F7646FE9C150279F6A0AF29F44FD58071DA0997295EB2EF903B321
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7AD468 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CallEncodePointerTranslator
                                                                                                                                                  • String ID: MOC$RCC
                                                                                                                                                  • API String ID: 3544855599-2084237596
                                                                                                                                                  • Opcode ID: f09742bcba9082defbae069630545238114b431a0e4fd7be58dd8469a5d7fef1
                                                                                                                                                  • Instruction ID: e32ea7e34947616c448e8fe8d4fcffbe01d11c99797d9df8b0b78445e995f7f4
                                                                                                                                                  • Opcode Fuzzy Hash: f09742bcba9082defbae069630545238114b431a0e4fd7be58dd8469a5d7fef1
                                                                                                                                                  • Instruction Fuzzy Hash: 6D616A76A08B499AE710EFA5D4803ADB7A0FB48B8CF444225EF4D17B98EF78E055D710
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7AD7C4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                                                                                                  • String ID: csm$csm
                                                                                                                                                  • API String ID: 3896166516-3733052814
                                                                                                                                                  • Opcode ID: a3990994d2fbb822c09bdc2a35b5fa2b647080e9aebb1a5b00e12dffe7bfe986
                                                                                                                                                  • Instruction ID: 6442dccb38bb96ea3a04bbed2afc9502356daac3ec9170fa1eb8f9997e9952ff
                                                                                                                                                  • Opcode Fuzzy Hash: a3990994d2fbb822c09bdc2a35b5fa2b647080e9aebb1a5b00e12dffe7bfe986
                                                                                                                                                  • Instruction Fuzzy Hash: 6551E33290C24AA6EB60AF959444378B7A0FB49B94F884132EA9C47BD5FF3CF450D710
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7A2CD0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetModuleFileNameW.KERNEL32(?,00007FF73D7A27C9,?,?,?,?,?,?), ref: 00007FF73D7A2D01
                                                                                                                                                    • Part of subcall function 00007FF73D7A1CB0: GetLastError.KERNEL32(?,?,00000000,00007FF73D7A6904,?,?,?,?,?,?,?,?,?,?,?,00007FF73D7A1023), ref: 00007FF73D7A1CD7
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ErrorFileLastModuleName
                                                                                                                                                  • String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
                                                                                                                                                  • API String ID: 2776309574-1977442011
                                                                                                                                                  • Opcode ID: 7987a5ce4ff3c8cba7d8c38c60f2d05ca27952d1a3ea66f3204455115dc1ef10
                                                                                                                                                  • Instruction ID: 22e7f05a44c0b878c080dcbc08135b3a5094b3faa20fb1b8d8d6afb9ac802d61
                                                                                                                                                  • Opcode Fuzzy Hash: 7987a5ce4ff3c8cba7d8c38c60f2d05ca27952d1a3ea66f3204455115dc1ef10
                                                                                                                                                  • Instruction Fuzzy Hash: EC017C61B1D64AB5FA61B7A0E8153B59291BF5C3C1FC01032D88E8B396FF1CF254A720
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BBBD0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2718003287-0
                                                                                                                                                  • Opcode ID: 47f9f7c1e3185106a498671fedee26090088e719dd8e44b73d57f810765c87d4
                                                                                                                                                  • Instruction ID: ae25286e6347ef5d88ca17dee857a11b0038008cae33ad8052fbb896aa10f2b5
                                                                                                                                                  • Opcode Fuzzy Hash: 47f9f7c1e3185106a498671fedee26090088e719dd8e44b73d57f810765c87d4
                                                                                                                                                  • Instruction Fuzzy Hash: 87D10372B0CA8999E711DFB5C4402ACB771FB58B98B804136DE4E97B99EF38E006D710
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7C4DBC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                                                                                                  • String ID: ?
                                                                                                                                                  • API String ID: 1286766494-1684325040
                                                                                                                                                  • Opcode ID: 610c018c2ed3d43a6dc6b39dfd7623f8c002a97b49fdc2d3a9d4eaa2ab755e24
                                                                                                                                                  • Instruction ID: 0f513155ee7fa2740f6b051a68b69dd75d8d2a38752f1daea3a4750a8767295f
                                                                                                                                                  • Opcode Fuzzy Hash: 610c018c2ed3d43a6dc6b39dfd7623f8c002a97b49fdc2d3a9d4eaa2ab755e24
                                                                                                                                                  • Instruction Fuzzy Hash: 4C414C12A0C68A69FB20ABB5D401379D660EB98BB8F944235EE9D07AD5FF3CF441D710
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7B7FD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • _invalid_parameter_noinfo.LIBCMT ref: 00007FF73D7B8002
                                                                                                                                                    • Part of subcall function 00007FF73D7B9F78: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF73D7C1EC2,?,?,?,00007FF73D7C1EFF,?,?,00000000,00007FF73D7C23C5,?,?,00000000,00007FF73D7C22F7), ref: 00007FF73D7B9F8E
                                                                                                                                                    • Part of subcall function 00007FF73D7B9F78: GetLastError.KERNEL32(?,?,?,00007FF73D7C1EC2,?,?,?,00007FF73D7C1EFF,?,?,00000000,00007FF73D7C23C5,?,?,00000000,00007FF73D7C22F7), ref: 00007FF73D7B9F98
                                                                                                                                                  • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF73D7AA485), ref: 00007FF73D7B8020
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ErrorFileLanguagesLastModuleNamePreferredRestoreThread_invalid_parameter_noinfo
                                                                                                                                                  • String ID: C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                  • API String ID: 2553983749-2892895399
                                                                                                                                                  • Opcode ID: 87397ab4d942c93eb7ecf5272dbc7224ab3e9c0a5ace0b49458789d652eb9e0d
                                                                                                                                                  • Instruction ID: d77b968abe8ace9e80dce9286fd5fb6461789b5b305ccf334dc3065e768a0ef6
                                                                                                                                                  • Opcode Fuzzy Hash: 87397ab4d942c93eb7ecf5272dbc7224ab3e9c0a5ace0b49458789d652eb9e0d
                                                                                                                                                  • Instruction Fuzzy Hash: 24417F36A0CB1AA6E714AF61D8410B8A7A4EF5C7D4BD45035FA4E43B95EF3CF4819360
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BC268 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ErrorFileLastWrite
                                                                                                                                                  • String ID: U
                                                                                                                                                  • API String ID: 442123175-4171548499
                                                                                                                                                  • Opcode ID: 3868b3aae24abb70b6c7ced641cfa87b6d54125405e373b4c87f7bfc476be08b
                                                                                                                                                  • Instruction ID: 9edfc7421728f929e1d956788be6f19ecaa2f95af8da7f4f0660ca1b86ca2057
                                                                                                                                                  • Opcode Fuzzy Hash: 3868b3aae24abb70b6c7ced641cfa87b6d54125405e373b4c87f7bfc476be08b
                                                                                                                                                  • Instruction Fuzzy Hash: D741B422A1CA89A5DB609FA5E8443A9B760FB98794FC44031EE4D87758EF3CE441D750
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BE588 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CurrentDirectory
                                                                                                                                                  • String ID: :
                                                                                                                                                  • API String ID: 1611563598-336475711
                                                                                                                                                  • Opcode ID: f9a3a88e5e7675db83ee30e7457ef94258ee056855d46160e54cb350838ff185
                                                                                                                                                  • Instruction ID: 1755fc556a1da28170fabbc13df5f88811531fbffdda114b307d6996ab2c44c4
                                                                                                                                                  • Opcode Fuzzy Hash: f9a3a88e5e7675db83ee30e7457ef94258ee056855d46160e54cb350838ff185
                                                                                                                                                  • Instruction Fuzzy Hash: 8721F222B1C28995EB28AB55D04426DB3B1FB9CB88FC54035D68D43384EF7CF945DB60
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7AE310 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ExceptionFileHeaderRaise
                                                                                                                                                  • String ID: csm
                                                                                                                                                  • API String ID: 2573137834-1018135373
                                                                                                                                                  • Opcode ID: ee4cd62d6736e0f26efa3482034fbaa09f2706f16dc7c85cfdea4997af4e44da
                                                                                                                                                  • Instruction ID: 896f1a36c061e744c92c871ba5f30433224728dfba85e74b9cc71077110cc293
                                                                                                                                                  • Opcode Fuzzy Hash: ee4cd62d6736e0f26efa3482034fbaa09f2706f16dc7c85cfdea4997af4e44da
                                                                                                                                                  • Instruction Fuzzy Hash: E6111C32A1CB4992EB219F55F440269B7A5FB88B94F584231EECD07768EF3CE5519B00
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BF08C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000001.00000002.2450600305.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000001.00000002.2450359287.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450659707.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450722238.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000001.00000002.2450846455.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_1_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: DriveType_invalid_parameter_noinfo
                                                                                                                                                  • String ID: :
                                                                                                                                                  • API String ID: 2595371189-336475711
                                                                                                                                                  • Opcode ID: 231bdef7d4e4c9a314d514652501e8a1bb3d1d6653b2e53c967e9d93a887682d
                                                                                                                                                  • Instruction ID: 01075045691a855fd7fa22316cf7812ff9c93fe3af67931ac36722cdd7d10247
                                                                                                                                                  • Opcode Fuzzy Hash: 231bdef7d4e4c9a314d514652501e8a1bb3d1d6653b2e53c967e9d93a887682d
                                                                                                                                                  • Instruction Fuzzy Hash: 67017161A1C60A96E720BFE0946127EE3A0EF5DB04FC40036D58D86691FF2DF545A634
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Execution Graph

                                                                                                                                                  Execution Coverage:2.3%
                                                                                                                                                  Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                  Signature Coverage:1%
                                                                                                                                                  Total number of Nodes:820
                                                                                                                                                  Total number of Limit Nodes:24
                                                                                                                                                  execution_graph 63254 7ff8a84fcde0 63255 7ff8a84fd981 63254->63255 63262 7ff8a84fcdf8 63254->63262 63256 7ff8a84fd88e LoadLibraryA 63257 7ff8a84fd8a8 63256->63257 63260 7ff8a84fd8c7 GetProcAddress 63257->63260 63257->63262 63259 7ff8a84fd8e9 VirtualProtect VirtualProtect 63259->63255 63260->63257 63261 7ff8a84fd8de 63260->63261 63262->63256 63262->63259 63263 7ff73d7b8919 63275 7ff73d7b9238 63263->63275 63265 7ff73d7b891e 63266 7ff73d7b898f 63265->63266 63267 7ff73d7b8945 GetModuleHandleW 63265->63267 63268 7ff73d7b881c 11 API calls 63266->63268 63267->63266 63273 7ff73d7b8952 63267->63273 63269 7ff73d7b89cb 63268->63269 63270 7ff73d7b89d2 63269->63270 63271 7ff73d7b89e8 11 API calls 63269->63271 63272 7ff73d7b89e4 63271->63272 63273->63266 63274 7ff73d7b8a40 GetModuleHandleExW GetProcAddress FreeLibrary 63273->63274 63274->63266 63280 7ff73d7ba780 45 API calls 3 library calls 63275->63280 63277 7ff73d7b9241 63281 7ff73d7b936c 45 API calls 2 library calls 63277->63281 63280->63277 63282 7ff73d7be95c 63283 7ff73d7beb4e 63282->63283 63286 7ff73d7be99e _isindst 63282->63286 63328 7ff73d7b6088 11 API calls _findclose 63283->63328 63286->63283 63288 7ff73d7bea1e _isindst 63286->63288 63303 7ff73d7c5434 63288->63303 63293 7ff73d7beb7a 63338 7ff73d7b9f30 IsProcessorFeaturePresent 63293->63338 63300 7ff73d7bea7b 63302 7ff73d7beb3e 63300->63302 63327 7ff73d7c5478 37 API calls _isindst 63300->63327 63329 7ff73d7aa100 63302->63329 63304 7ff73d7c5443 63303->63304 63308 7ff73d7bea3c 63303->63308 63342 7ff73d7bf808 EnterCriticalSection 63304->63342 63306 7ff73d7c544b 63307 7ff73d7c52a4 55 API calls 63306->63307 63306->63308 63307->63308 63309 7ff73d7c4838 63308->63309 63310 7ff73d7c4841 63309->63310 63311 7ff73d7bea51 63309->63311 63343 7ff73d7b6088 11 API calls _findclose 63310->63343 63311->63293 63315 7ff73d7c4868 63311->63315 63313 7ff73d7c4846 63344 7ff73d7b9f10 37 API calls _invalid_parameter_noinfo 63313->63344 63316 7ff73d7c4871 63315->63316 63320 7ff73d7bea62 63315->63320 63345 7ff73d7b6088 11 API calls _findclose 63316->63345 63318 7ff73d7c4876 63346 7ff73d7b9f10 37 API calls _invalid_parameter_noinfo 63318->63346 63320->63293 63321 7ff73d7c4898 63320->63321 63322 7ff73d7c48a1 63321->63322 63323 7ff73d7bea73 63321->63323 63347 7ff73d7b6088 11 API calls _findclose 63322->63347 63323->63293 63323->63300 63325 7ff73d7c48a6 63348 7ff73d7b9f10 37 API calls _invalid_parameter_noinfo 63325->63348 63327->63302 63328->63302 63330 7ff73d7aa109 63329->63330 63331 7ff73d7aa114 63330->63331 63332 7ff73d7aa1c0 IsProcessorFeaturePresent 63330->63332 63333 7ff73d7aa1d8 63332->63333 63349 7ff73d7aa3b4 RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind 63333->63349 63335 7ff73d7aa1eb 63350 7ff73d7aa180 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 63335->63350 63339 7ff73d7b9f43 63338->63339 63351 7ff73d7b9c44 14 API calls 2 library calls 63339->63351 63341 7ff73d7b9f5e GetCurrentProcess TerminateProcess 63343->63313 63345->63318 63347->63325 63349->63335 63351->63341 63352 7ff73d7aa51c 63373 7ff73d7aa6fc 63352->63373 63355 7ff73d7aa673 63474 7ff73d7aaa2c 7 API calls 2 library calls 63355->63474 63356 7ff73d7aa53d __scrt_acquire_startup_lock 63358 7ff73d7aa67d 63356->63358 63364 7ff73d7aa55b __scrt_release_startup_lock 63356->63364 63475 7ff73d7aaa2c 7 API calls 2 library calls 63358->63475 63360 7ff73d7aa580 63361 7ff73d7aa688 __GetCurrentState 63362 7ff73d7aa606 63381 7ff73d7b8738 63362->63381 63364->63360 63364->63362 63471 7ff73d7b8ae4 45 API calls 63364->63471 63366 7ff73d7aa60b 63387 7ff73d7a1000 63366->63387 63370 7ff73d7aa62f 63370->63361 63473 7ff73d7aa890 7 API calls __scrt_initialize_crt 63370->63473 63372 7ff73d7aa646 63372->63360 63476 7ff73d7aaccc 63373->63476 63376 7ff73d7aa72b 63478 7ff73d7b91ec 63376->63478 63380 7ff73d7aa535 63380->63355 63380->63356 63382 7ff73d7b8748 63381->63382 63386 7ff73d7b875d 63381->63386 63382->63386 63495 7ff73d7b81c8 40 API calls __free_lconv_num 63382->63495 63384 7ff73d7b8766 63384->63386 63496 7ff73d7b8588 12 API calls 3 library calls 63384->63496 63386->63366 63388 7ff73d7a1011 63387->63388 63497 7ff73d7a67c0 63388->63497 63390 7ff73d7a1023 63504 7ff73d7b4f7c 63390->63504 63392 7ff73d7a27ab 63511 7ff73d7a1af0 63392->63511 63396 7ff73d7aa100 _wfindfirst32i64 8 API calls 63397 7ff73d7a28de 63396->63397 63472 7ff73d7aab80 GetModuleHandleW 63397->63472 63398 7ff73d7a27c9 63462 7ff73d7a28ca 63398->63462 63527 7ff73d7a2c50 63398->63527 63400 7ff73d7a27fb 63400->63462 63530 7ff73d7a5af0 63400->63530 63402 7ff73d7a2817 63403 7ff73d7a2863 63402->63403 63405 7ff73d7a5af0 92 API calls 63402->63405 63545 7ff73d7a60f0 63403->63545 63409 7ff73d7a2838 __std_exception_destroy 63405->63409 63406 7ff73d7a2878 63549 7ff73d7a19d0 63406->63549 63409->63403 63413 7ff73d7a60f0 89 API calls 63409->63413 63410 7ff73d7a296d 63411 7ff73d7a2998 63410->63411 63645 7ff73d7a24a0 86 API calls 63410->63645 63420 7ff73d7a29db 63411->63420 63560 7ff73d7a6db0 63411->63560 63412 7ff73d7a19d0 121 API calls 63416 7ff73d7a28ae 63412->63416 63413->63403 63418 7ff73d7a28f0 63416->63418 63419 7ff73d7a28b2 63416->63419 63417 7ff73d7a29b8 63421 7ff73d7a29ce SetDllDirectoryW 63417->63421 63422 7ff73d7a29bd 63417->63422 63418->63410 63622 7ff73d7a2de0 63418->63622 63616 7ff73d7a1c50 63419->63616 63574 7ff73d7a4fa0 63420->63574 63421->63420 63426 7ff73d7a1c50 86 API calls 63422->63426 63426->63462 63429 7ff73d7a2a36 63436 7ff73d7a2af6 63429->63436 63443 7ff73d7a2a49 63429->63443 63430 7ff73d7a2912 63433 7ff73d7a1c50 86 API calls 63430->63433 63433->63462 63434 7ff73d7a29f8 63434->63429 63647 7ff73d7a47a0 158 API calls 3 library calls 63434->63647 63435 7ff73d7a2940 63435->63410 63437 7ff73d7a2945 63435->63437 63606 7ff73d7a2330 63436->63606 63641 7ff73d7ae60c 63437->63641 63441 7ff73d7a2a09 63444 7ff73d7a2a2c 63441->63444 63445 7ff73d7a2a0d 63441->63445 63442 7ff73d7a2b03 63442->63462 63656 7ff73d7a6080 88 API calls __std_exception_destroy 63442->63656 63450 7ff73d7a2a95 63443->63450 63651 7ff73d7a1b30 63443->63651 63650 7ff73d7a49f0 FreeLibrary 63444->63650 63648 7ff73d7a4730 120 API calls 63445->63648 63450->63462 63578 7ff73d7a22d0 63450->63578 63451 7ff73d7a2a17 63451->63444 63453 7ff73d7a2a1b 63451->63453 63452 7ff73d7a2b2b 63454 7ff73d7a5af0 92 API calls 63452->63454 63649 7ff73d7a4df0 87 API calls 63453->63649 63458 7ff73d7a2b37 63454->63458 63456 7ff73d7a2ad1 63655 7ff73d7a49f0 FreeLibrary 63456->63655 63460 7ff73d7a2b48 63458->63460 63458->63462 63459 7ff73d7a2a2a 63459->63429 63657 7ff73d7a6130 94 API calls 2 library calls 63460->63657 63462->63396 63464 7ff73d7a2b60 63658 7ff73d7a49f0 FreeLibrary 63464->63658 63466 7ff73d7a2b6c 63467 7ff73d7a2b87 63466->63467 63659 7ff73d7a5df0 98 API calls 2 library calls 63466->63659 63660 7ff73d7a1ab0 74 API calls __std_exception_destroy 63467->63660 63470 7ff73d7a2b8f 63470->63462 63471->63362 63472->63370 63473->63372 63474->63358 63475->63361 63477 7ff73d7aa71e __scrt_dllmain_crt_thread_attach 63476->63477 63477->63376 63477->63380 63479 7ff73d7c264c 63478->63479 63480 7ff73d7aa730 63479->63480 63483 7ff73d7bbb50 63479->63483 63480->63380 63482 7ff73d7abe28 7 API calls 2 library calls 63480->63482 63482->63380 63494 7ff73d7bf808 EnterCriticalSection 63483->63494 63485 7ff73d7bbb60 63486 7ff73d7b6ca8 43 API calls 63485->63486 63487 7ff73d7bbb69 63486->63487 63488 7ff73d7bbb77 63487->63488 63489 7ff73d7bb958 45 API calls 63487->63489 63490 7ff73d7bf868 _isindst LeaveCriticalSection 63488->63490 63491 7ff73d7bbb72 63489->63491 63492 7ff73d7bbb83 63490->63492 63493 7ff73d7bba48 GetStdHandle GetFileType 63491->63493 63492->63479 63493->63488 63495->63384 63496->63386 63499 7ff73d7a67df 63497->63499 63498 7ff73d7a6830 WideCharToMultiByte 63498->63499 63501 7ff73d7a68d8 63498->63501 63499->63498 63499->63501 63502 7ff73d7a6886 WideCharToMultiByte 63499->63502 63503 7ff73d7a67e7 __std_exception_destroy 63499->63503 63661 7ff73d7a1cb0 86 API calls 63501->63661 63502->63499 63502->63501 63503->63390 63507 7ff73d7becc0 63504->63507 63505 7ff73d7bed13 63662 7ff73d7b9e44 37 API calls 2 library calls 63505->63662 63507->63505 63508 7ff73d7bed66 63507->63508 63663 7ff73d7beb98 71 API calls _fread_nolock 63508->63663 63510 7ff73d7bed3c 63510->63392 63512 7ff73d7a1b05 63511->63512 63513 7ff73d7a1b20 63512->63513 63664 7ff73d7a1c10 86 API calls 63512->63664 63513->63462 63515 7ff73d7a2cd0 63513->63515 63665 7ff73d7aa130 63515->63665 63518 7ff73d7a2d22 63668 7ff73d7a6ec0 88 API calls 63518->63668 63519 7ff73d7a2d0b 63667 7ff73d7a1cb0 86 API calls 63519->63667 63522 7ff73d7a2d35 63523 7ff73d7a2d1e 63522->63523 63524 7ff73d7a1c50 86 API calls 63522->63524 63525 7ff73d7aa100 _wfindfirst32i64 8 API calls 63523->63525 63524->63523 63526 7ff73d7a2d5f 63525->63526 63526->63398 63528 7ff73d7a1b30 49 API calls 63527->63528 63529 7ff73d7a2c6d 63528->63529 63529->63400 63531 7ff73d7a5afa 63530->63531 63532 7ff73d7a6db0 88 API calls 63531->63532 63533 7ff73d7a5b1c GetEnvironmentVariableW 63532->63533 63534 7ff73d7a5b34 ExpandEnvironmentStringsW 63533->63534 63535 7ff73d7a5b86 63533->63535 63669 7ff73d7a6ec0 88 API calls 63534->63669 63536 7ff73d7aa100 _wfindfirst32i64 8 API calls 63535->63536 63538 7ff73d7a5b98 63536->63538 63538->63402 63539 7ff73d7a5b5c 63539->63535 63540 7ff73d7a5b66 63539->63540 63670 7ff73d7b926c 37 API calls 2 library calls 63540->63670 63542 7ff73d7a5b6e 63543 7ff73d7aa100 _wfindfirst32i64 8 API calls 63542->63543 63544 7ff73d7a5b7e 63543->63544 63544->63402 63546 7ff73d7a6db0 88 API calls 63545->63546 63547 7ff73d7a6107 SetEnvironmentVariableW 63546->63547 63548 7ff73d7a611f __std_exception_destroy 63547->63548 63548->63406 63550 7ff73d7a1b30 49 API calls 63549->63550 63551 7ff73d7a1a00 63550->63551 63552 7ff73d7a1b30 49 API calls 63551->63552 63559 7ff73d7a1a7a 63551->63559 63553 7ff73d7a1a22 63552->63553 63554 7ff73d7a2c50 49 API calls 63553->63554 63553->63559 63555 7ff73d7a1a3b 63554->63555 63671 7ff73d7a17b0 63555->63671 63558 7ff73d7ae60c 74 API calls 63558->63559 63559->63410 63559->63412 63561 7ff73d7a6dd1 MultiByteToWideChar 63560->63561 63562 7ff73d7a6e57 MultiByteToWideChar 63560->63562 63565 7ff73d7a6df7 63561->63565 63566 7ff73d7a6e1c 63561->63566 63563 7ff73d7a6e9f 63562->63563 63564 7ff73d7a6e7a 63562->63564 63563->63417 63754 7ff73d7a1cb0 86 API calls 63564->63754 63752 7ff73d7a1cb0 86 API calls 63565->63752 63566->63562 63571 7ff73d7a6e32 63566->63571 63569 7ff73d7a6e8d 63569->63417 63570 7ff73d7a6e0a 63570->63417 63753 7ff73d7a1cb0 86 API calls 63571->63753 63573 7ff73d7a6e45 63573->63417 63575 7ff73d7a4fb5 63574->63575 63576 7ff73d7a29e0 63575->63576 63755 7ff73d7a1c10 86 API calls 63575->63755 63576->63429 63646 7ff73d7a4c40 120 API calls 2 library calls 63576->63646 63756 7ff73d7a3ac0 63578->63756 63581 7ff73d7a231d 63581->63456 63583 7ff73d7a22f4 63583->63581 63812 7ff73d7a3840 63583->63812 63585 7ff73d7a2300 63585->63581 63822 7ff73d7a39a0 63585->63822 63587 7ff73d7a230c 63587->63581 63588 7ff73d7a2547 63587->63588 63589 7ff73d7a255c 63587->63589 63590 7ff73d7a1c50 86 API calls 63588->63590 63591 7ff73d7a257c 63589->63591 63601 7ff73d7a2592 __std_exception_destroy 63589->63601 63595 7ff73d7a2553 63590->63595 63593 7ff73d7a1c50 86 API calls 63591->63593 63592 7ff73d7aa100 _wfindfirst32i64 8 API calls 63594 7ff73d7a26ea 63592->63594 63593->63595 63594->63456 63595->63592 63598 7ff73d7a1b30 49 API calls 63598->63601 63599 7ff73d7a273f 63600 7ff73d7a1c50 86 API calls 63599->63600 63600->63595 63601->63595 63601->63598 63601->63599 63602 7ff73d7a2719 63601->63602 63604 7ff73d7a26f6 63601->63604 63827 7ff73d7a12b0 63601->63827 63853 7ff73d7a1780 86 API calls 63601->63853 63603 7ff73d7a1c50 86 API calls 63602->63603 63603->63595 63605 7ff73d7a1c50 86 API calls 63604->63605 63605->63595 63612 7ff73d7a23a3 63606->63612 63615 7ff73d7a23e4 63606->63615 63607 7ff73d7a2423 63609 7ff73d7aa100 _wfindfirst32i64 8 API calls 63607->63609 63610 7ff73d7a2435 63609->63610 63610->63442 63612->63615 63937 7ff73d7a1dc0 63612->63937 63992 7ff73d7a1440 158 API calls 2 library calls 63612->63992 63994 7ff73d7a1780 86 API calls 63612->63994 63615->63607 63993 7ff73d7a1ab0 74 API calls __std_exception_destroy 63615->63993 63617 7ff73d7a1c6e 63616->63617 64140 7ff73d7a1b90 63617->64140 63623 7ff73d7a2dec 63622->63623 63624 7ff73d7a6db0 88 API calls 63623->63624 63625 7ff73d7a2e17 63624->63625 63626 7ff73d7a6db0 88 API calls 63625->63626 63627 7ff73d7a2e2a 63626->63627 64189 7ff73d7b5538 63627->64189 63630 7ff73d7aa100 _wfindfirst32i64 8 API calls 63631 7ff73d7a290a 63630->63631 63631->63430 63632 7ff73d7a6360 63631->63632 63633 7ff73d7a6384 63632->63633 63634 7ff73d7aec94 73 API calls 63633->63634 63639 7ff73d7a645b __std_exception_destroy 63633->63639 63635 7ff73d7a639e 63634->63635 63635->63639 64355 7ff73d7b7a9c 63635->64355 63637 7ff73d7aec94 73 API calls 63640 7ff73d7a63b3 63637->63640 63638 7ff73d7ae95c _fread_nolock 53 API calls 63638->63640 63639->63435 63640->63637 63640->63638 63640->63639 63642 7ff73d7ae63c 63641->63642 64371 7ff73d7ae3e8 63642->64371 63644 7ff73d7ae655 63644->63430 63645->63411 63646->63434 63647->63441 63648->63451 63649->63459 63650->63429 63652 7ff73d7a1b55 63651->63652 63653 7ff73d7b3c80 49 API calls 63652->63653 63654 7ff73d7a1b78 63653->63654 63654->63450 63655->63462 63656->63452 63657->63464 63658->63466 63659->63467 63660->63470 63661->63503 63662->63510 63663->63510 63664->63513 63666 7ff73d7a2cdc GetModuleFileNameW 63665->63666 63666->63518 63666->63519 63667->63523 63668->63522 63669->63539 63670->63542 63672 7ff73d7a17e4 63671->63672 63673 7ff73d7a17d4 63671->63673 63675 7ff73d7a6360 83 API calls 63672->63675 63704 7ff73d7a1842 63672->63704 63674 7ff73d7a2de0 120 API calls 63673->63674 63674->63672 63676 7ff73d7a1815 63675->63676 63676->63704 63705 7ff73d7aec94 63676->63705 63678 7ff73d7a182b 63680 7ff73d7a182f 63678->63680 63681 7ff73d7a184c 63678->63681 63679 7ff73d7aa100 _wfindfirst32i64 8 API calls 63682 7ff73d7a19c0 63679->63682 63718 7ff73d7a1c10 86 API calls 63680->63718 63709 7ff73d7ae95c 63681->63709 63682->63558 63682->63559 63686 7ff73d7aec94 73 API calls 63688 7ff73d7a18d1 63686->63688 63689 7ff73d7a18e3 63688->63689 63690 7ff73d7a18fe 63688->63690 63720 7ff73d7a1c10 86 API calls 63689->63720 63692 7ff73d7ae95c _fread_nolock 53 API calls 63690->63692 63693 7ff73d7a1913 63692->63693 63694 7ff73d7a1925 63693->63694 63695 7ff73d7a1867 63693->63695 63712 7ff73d7ae6d0 63694->63712 63719 7ff73d7a1c10 86 API calls 63695->63719 63698 7ff73d7a193d 63699 7ff73d7a1c50 86 API calls 63698->63699 63699->63704 63700 7ff73d7a1993 63702 7ff73d7ae60c 74 API calls 63700->63702 63700->63704 63701 7ff73d7a1950 63701->63700 63703 7ff73d7a1c50 86 API calls 63701->63703 63702->63704 63703->63700 63704->63679 63706 7ff73d7aecc4 63705->63706 63721 7ff73d7aea24 63706->63721 63708 7ff73d7aecdd 63708->63678 63734 7ff73d7ae97c 63709->63734 63713 7ff73d7ae6d9 63712->63713 63714 7ff73d7a1939 63712->63714 63750 7ff73d7b6088 11 API calls _findclose 63713->63750 63714->63698 63714->63701 63716 7ff73d7ae6de 63751 7ff73d7b9f10 37 API calls _invalid_parameter_noinfo 63716->63751 63718->63704 63719->63704 63720->63704 63722 7ff73d7aea8e 63721->63722 63723 7ff73d7aea4e 63721->63723 63722->63723 63724 7ff73d7aea9a 63722->63724 63733 7ff73d7b9e44 37 API calls 2 library calls 63723->63733 63732 7ff73d7b438c EnterCriticalSection 63724->63732 63727 7ff73d7aea9f 63728 7ff73d7aeba8 71 API calls 63727->63728 63729 7ff73d7aeab1 63728->63729 63730 7ff73d7b4398 _fread_nolock LeaveCriticalSection 63729->63730 63731 7ff73d7aea75 63730->63731 63731->63708 63733->63731 63735 7ff73d7a1861 63734->63735 63736 7ff73d7ae9a6 63734->63736 63735->63686 63735->63695 63736->63735 63737 7ff73d7ae9f2 63736->63737 63738 7ff73d7ae9b5 memcpy_s 63736->63738 63747 7ff73d7b438c EnterCriticalSection 63737->63747 63748 7ff73d7b6088 11 API calls _findclose 63738->63748 63741 7ff73d7ae9fa 63743 7ff73d7ae6fc _fread_nolock 51 API calls 63741->63743 63742 7ff73d7ae9ca 63749 7ff73d7b9f10 37 API calls _invalid_parameter_noinfo 63742->63749 63745 7ff73d7aea11 63743->63745 63746 7ff73d7b4398 _fread_nolock LeaveCriticalSection 63745->63746 63746->63735 63748->63742 63750->63716 63752->63570 63753->63573 63754->63569 63755->63576 63757 7ff73d7a3ad0 63756->63757 63758 7ff73d7a1b30 49 API calls 63757->63758 63759 7ff73d7a3b02 63758->63759 63760 7ff73d7a3b2b 63759->63760 63761 7ff73d7a3b0b 63759->63761 63763 7ff73d7a3b82 63760->63763 63854 7ff73d7a2e60 63760->63854 63762 7ff73d7a1c50 86 API calls 63761->63762 63783 7ff73d7a3b21 63762->63783 63765 7ff73d7a2e60 49 API calls 63763->63765 63767 7ff73d7a3b9b 63765->63767 63766 7ff73d7a3b4c 63768 7ff73d7a3b6a 63766->63768 63771 7ff73d7a1c50 86 API calls 63766->63771 63770 7ff73d7a3bb9 63767->63770 63774 7ff73d7a1c50 86 API calls 63767->63774 63857 7ff73d7a2d70 63768->63857 63769 7ff73d7aa100 _wfindfirst32i64 8 API calls 63773 7ff73d7a22de 63769->63773 63775 7ff73d7a6310 89 API calls 63770->63775 63771->63768 63773->63581 63784 7ff73d7a3e40 63773->63784 63774->63770 63776 7ff73d7a3bc6 63775->63776 63777 7ff73d7a3bcb 63776->63777 63778 7ff73d7a3bed 63776->63778 63867 7ff73d7a1cb0 86 API calls 63777->63867 63868 7ff73d7a2f20 141 API calls 63778->63868 63783->63769 63785 7ff73d7a5af0 92 API calls 63784->63785 63788 7ff73d7a3e55 63785->63788 63786 7ff73d7a3e70 63787 7ff73d7a6db0 88 API calls 63786->63787 63790 7ff73d7a3eb4 63787->63790 63788->63786 63789 7ff73d7a1c50 86 API calls 63788->63789 63789->63786 63791 7ff73d7a3ed0 63790->63791 63792 7ff73d7a3eb9 63790->63792 63795 7ff73d7a6db0 88 API calls 63791->63795 63793 7ff73d7a1c50 86 API calls 63792->63793 63794 7ff73d7a3ec5 63793->63794 63794->63583 63796 7ff73d7a3f05 63795->63796 63798 7ff73d7a1b30 49 API calls 63796->63798 63810 7ff73d7a3f0a __std_exception_destroy 63796->63810 63797 7ff73d7a1c50 86 API calls 63799 7ff73d7a40b1 63797->63799 63800 7ff73d7a3f87 63798->63800 63799->63583 63801 7ff73d7a3fb3 63800->63801 63802 7ff73d7a3f8e 63800->63802 63804 7ff73d7a6db0 88 API calls 63801->63804 63803 7ff73d7a1c50 86 API calls 63802->63803 63805 7ff73d7a3fa3 63803->63805 63806 7ff73d7a3fcc 63804->63806 63805->63583 63806->63810 63869 7ff73d7a3c20 63806->63869 63810->63797 63811 7ff73d7a409a 63810->63811 63811->63583 63813 7ff73d7a3857 63812->63813 63813->63813 63814 7ff73d7a3880 63813->63814 63821 7ff73d7a3897 __std_exception_destroy 63813->63821 63815 7ff73d7a1c50 86 API calls 63814->63815 63816 7ff73d7a388c 63815->63816 63816->63585 63817 7ff73d7a397b 63817->63585 63818 7ff73d7a12b0 120 API calls 63818->63821 63820 7ff73d7a1c50 86 API calls 63820->63821 63821->63817 63821->63818 63821->63820 63911 7ff73d7a1780 86 API calls 63821->63911 63824 7ff73d7a3aa7 63822->63824 63825 7ff73d7a39bb 63822->63825 63824->63587 63825->63824 63826 7ff73d7a1c50 86 API calls 63825->63826 63912 7ff73d7a1780 86 API calls 63825->63912 63826->63825 63828 7ff73d7a12c6 63827->63828 63829 7ff73d7a12f8 63827->63829 63830 7ff73d7a2de0 120 API calls 63828->63830 63831 7ff73d7aec94 73 API calls 63829->63831 63832 7ff73d7a12d6 63830->63832 63833 7ff73d7a130a 63831->63833 63832->63829 63834 7ff73d7a12de 63832->63834 63835 7ff73d7a132f 63833->63835 63836 7ff73d7a130e 63833->63836 63837 7ff73d7a1c50 86 API calls 63834->63837 63841 7ff73d7a1364 63835->63841 63842 7ff73d7a1344 63835->63842 63931 7ff73d7a1c10 86 API calls 63836->63931 63839 7ff73d7a12ee 63837->63839 63839->63601 63840 7ff73d7a1325 63840->63601 63844 7ff73d7a137e 63841->63844 63849 7ff73d7a1395 63841->63849 63932 7ff73d7a1c10 86 API calls 63842->63932 63913 7ff73d7a1050 63844->63913 63846 7ff73d7a1421 63846->63601 63847 7ff73d7ae95c _fread_nolock 53 API calls 63847->63849 63848 7ff73d7ae60c 74 API calls 63848->63846 63849->63847 63850 7ff73d7a135f __std_exception_destroy 63849->63850 63851 7ff73d7a13de 63849->63851 63850->63846 63850->63848 63933 7ff73d7a1c10 86 API calls 63851->63933 63853->63601 63855 7ff73d7a1b30 49 API calls 63854->63855 63856 7ff73d7a2e90 63855->63856 63856->63766 63858 7ff73d7a2d7a 63857->63858 63859 7ff73d7a6db0 88 API calls 63858->63859 63860 7ff73d7a2da2 63859->63860 63861 7ff73d7aa100 _wfindfirst32i64 8 API calls 63860->63861 63862 7ff73d7a2dca 63861->63862 63862->63763 63863 7ff73d7a6310 63862->63863 63864 7ff73d7a6db0 88 API calls 63863->63864 63865 7ff73d7a6327 LoadLibraryW 63864->63865 63866 7ff73d7a6344 __std_exception_destroy 63865->63866 63866->63763 63867->63783 63868->63783 63877 7ff73d7a3c3a 63869->63877 63870 7ff73d7a3df1 63871 7ff73d7aa100 _wfindfirst32i64 8 API calls 63870->63871 63872 7ff73d7a3e10 63871->63872 63896 7ff73d7a6fb0 88 API calls __std_exception_destroy 63872->63896 63875 7ff73d7a3d53 63875->63870 63899 7ff73d7b92e4 63875->63899 63877->63870 63877->63875 63879 7ff73d7a3e29 63877->63879 63897 7ff73d7b5740 47 API calls 63877->63897 63898 7ff73d7a1780 86 API calls 63877->63898 63881 7ff73d7a1c50 86 API calls 63879->63881 63881->63870 63882 7ff73d7a3d76 63883 7ff73d7b92e4 _fread_nolock 37 API calls 63882->63883 63884 7ff73d7a3d88 63883->63884 63906 7ff73d7b584c 39 API calls 3 library calls 63884->63906 63886 7ff73d7a3d94 63907 7ff73d7b5dd4 73 API calls 63886->63907 63888 7ff73d7a3da6 63908 7ff73d7b5dd4 73 API calls 63888->63908 63890 7ff73d7a3db8 63891 7ff73d7b4f7c 71 API calls 63890->63891 63892 7ff73d7a3dc9 63891->63892 63893 7ff73d7b4f7c 71 API calls 63892->63893 63894 7ff73d7a3ddd 63893->63894 63895 7ff73d7b4f7c 71 API calls 63894->63895 63895->63870 63896->63810 63897->63877 63898->63877 63900 7ff73d7a3d6a 63899->63900 63901 7ff73d7b92ed 63899->63901 63905 7ff73d7b584c 39 API calls 3 library calls 63900->63905 63909 7ff73d7b6088 11 API calls _findclose 63901->63909 63903 7ff73d7b92f2 63910 7ff73d7b9f10 37 API calls _invalid_parameter_noinfo 63903->63910 63905->63882 63906->63886 63907->63888 63908->63890 63909->63903 63911->63821 63912->63825 63914 7ff73d7a10a6 63913->63914 63915 7ff73d7a10d3 63914->63915 63916 7ff73d7a10ad 63914->63916 63919 7ff73d7a1109 63915->63919 63920 7ff73d7a10ed 63915->63920 63917 7ff73d7a1c50 86 API calls 63916->63917 63918 7ff73d7a10c0 63917->63918 63918->63850 63922 7ff73d7a111b 63919->63922 63930 7ff73d7a1137 memcpy_s 63919->63930 63934 7ff73d7a1c10 86 API calls 63920->63934 63935 7ff73d7a1c10 86 API calls 63922->63935 63924 7ff73d7ae95c _fread_nolock 53 API calls 63924->63930 63925 7ff73d7ae6d0 37 API calls 63925->63930 63926 7ff73d7a1104 __std_exception_destroy 63926->63850 63927 7ff73d7a11fe 63928 7ff73d7a1c50 86 API calls 63927->63928 63928->63926 63930->63924 63930->63925 63930->63926 63930->63927 63936 7ff73d7af09c 76 API calls 63930->63936 63931->63840 63932->63850 63933->63850 63934->63926 63935->63926 63936->63930 63938 7ff73d7a1dd6 63937->63938 63939 7ff73d7a1b30 49 API calls 63938->63939 63941 7ff73d7a1e0b 63939->63941 63940 7ff73d7a2211 63941->63940 63942 7ff73d7a2c50 49 API calls 63941->63942 63943 7ff73d7a1e7f 63942->63943 63995 7ff73d7a2230 63943->63995 63946 7ff73d7a1ec1 64003 7ff73d7a5880 127 API calls 63946->64003 63947 7ff73d7a1efa 63948 7ff73d7a2230 75 API calls 63947->63948 63951 7ff73d7a1f4c 63948->63951 63950 7ff73d7a1ec9 63952 7ff73d7a1eea 63950->63952 64004 7ff73d7a5760 138 API calls 2 library calls 63950->64004 63953 7ff73d7a1f50 63951->63953 63954 7ff73d7a1fb6 63951->63954 63958 7ff73d7a1c50 86 API calls 63952->63958 63959 7ff73d7a1ef3 63952->63959 64005 7ff73d7a5880 127 API calls 63953->64005 63956 7ff73d7a2230 75 API calls 63954->63956 63960 7ff73d7a1fe2 63956->63960 63958->63959 63963 7ff73d7aa100 _wfindfirst32i64 8 API calls 63959->63963 63962 7ff73d7a2042 63960->63962 63964 7ff73d7a2230 75 API calls 63960->63964 63961 7ff73d7a1f58 63961->63952 64006 7ff73d7a5760 138 API calls 2 library calls 63961->64006 63962->63940 64007 7ff73d7a5880 127 API calls 63962->64007 63967 7ff73d7a1fab 63963->63967 63968 7ff73d7a2012 63964->63968 63967->63612 63968->63962 63971 7ff73d7a2230 75 API calls 63968->63971 63969 7ff73d7a1f75 63969->63952 63970 7ff73d7a21f6 63969->63970 63975 7ff73d7a1c50 86 API calls 63970->63975 63971->63962 63972 7ff73d7a2052 63972->63940 63973 7ff73d7a1af0 86 API calls 63972->63973 63985 7ff73d7a216f 63972->63985 63974 7ff73d7a20af 63973->63974 63974->63940 63978 7ff73d7a1b30 49 API calls 63974->63978 63976 7ff73d7a216a 63975->63976 64010 7ff73d7a1ab0 74 API calls __std_exception_destroy 63976->64010 63979 7ff73d7a20d7 63978->63979 63979->63970 63981 7ff73d7a1b30 49 API calls 63979->63981 63980 7ff73d7a21db 63980->63970 64009 7ff73d7a1440 158 API calls 2 library calls 63980->64009 63982 7ff73d7a2104 63981->63982 63982->63970 63984 7ff73d7a1b30 49 API calls 63982->63984 63986 7ff73d7a2131 63984->63986 63985->63980 64008 7ff73d7a1780 86 API calls 63985->64008 63986->63970 63988 7ff73d7a17b0 121 API calls 63986->63988 63989 7ff73d7a2153 63988->63989 63989->63985 63990 7ff73d7a2157 63989->63990 63991 7ff73d7a1c50 86 API calls 63990->63991 63991->63976 63992->63612 63993->63615 63994->63612 63996 7ff73d7a2264 63995->63996 64011 7ff73d7b3c80 63996->64011 63999 7ff73d7a229b 64001 7ff73d7aa100 _wfindfirst32i64 8 API calls 63999->64001 64002 7ff73d7a1ebd 64001->64002 64002->63946 64002->63947 64003->63950 64004->63952 64005->63961 64006->63969 64007->63972 64008->63985 64009->63980 64010->63940 64012 7ff73d7b3cda 64011->64012 64013 7ff73d7b3cff 64012->64013 64015 7ff73d7b3d3b 64012->64015 64046 7ff73d7b9e44 37 API calls 2 library calls 64013->64046 64047 7ff73d7b16c4 49 API calls _invalid_parameter_noinfo 64015->64047 64017 7ff73d7b3e18 64020 7ff73d7b9f78 __free_lconv_num 11 API calls 64017->64020 64018 7ff73d7b3d29 64019 7ff73d7aa100 _wfindfirst32i64 8 API calls 64018->64019 64021 7ff73d7a228a 64019->64021 64020->64018 64021->63999 64029 7ff73d7b4e70 64021->64029 64022 7ff73d7b3dd2 64022->64017 64023 7ff73d7b3ded 64022->64023 64024 7ff73d7b3e3c 64022->64024 64027 7ff73d7b3de4 64022->64027 64048 7ff73d7b9f78 64023->64048 64024->64017 64025 7ff73d7b3e46 64024->64025 64028 7ff73d7b9f78 __free_lconv_num 11 API calls 64025->64028 64027->64017 64027->64023 64028->64018 64030 7ff73d7b4e99 64029->64030 64031 7ff73d7b4e8d 64029->64031 64080 7ff73d7b4a84 45 API calls __GetCurrentState 64030->64080 64055 7ff73d7b46e8 64031->64055 64034 7ff73d7b4ec1 64037 7ff73d7b4ed1 64034->64037 64081 7ff73d7be144 5 API calls __crtLCMapStringW 64034->64081 64035 7ff73d7b4e92 64035->63999 64082 7ff73d7b456c 14 API calls 3 library calls 64037->64082 64039 7ff73d7b4f29 64040 7ff73d7b4f41 64039->64040 64041 7ff73d7b4f2d 64039->64041 64042 7ff73d7b46e8 69 API calls 64040->64042 64041->64035 64043 7ff73d7b9f78 __free_lconv_num 11 API calls 64041->64043 64044 7ff73d7b4f4d 64042->64044 64043->64035 64044->64035 64045 7ff73d7b9f78 __free_lconv_num 11 API calls 64044->64045 64045->64035 64046->64018 64047->64022 64049 7ff73d7b9fac 64048->64049 64050 7ff73d7b9f7d HeapFree 64048->64050 64049->64018 64050->64049 64051 7ff73d7b9f98 GetLastError 64050->64051 64052 7ff73d7b9fa5 __free_lconv_num 64051->64052 64054 7ff73d7b6088 11 API calls _findclose 64052->64054 64054->64049 64056 7ff73d7b4702 64055->64056 64057 7ff73d7b471f 64055->64057 64109 7ff73d7b6068 11 API calls _findclose 64056->64109 64057->64056 64058 7ff73d7b4732 CreateFileW 64057->64058 64060 7ff73d7b4766 64058->64060 64061 7ff73d7b479c 64058->64061 64083 7ff73d7b483c GetFileType 64060->64083 64112 7ff73d7b4d60 46 API calls 3 library calls 64061->64112 64062 7ff73d7b4707 64110 7ff73d7b6088 11 API calls _findclose 64062->64110 64067 7ff73d7b47a1 64071 7ff73d7b47d0 64067->64071 64072 7ff73d7b47a5 64067->64072 64068 7ff73d7b470f 64111 7ff73d7b9f10 37 API calls _invalid_parameter_noinfo 64068->64111 64069 7ff73d7b4791 CloseHandle 64074 7ff73d7b471a 64069->64074 64070 7ff73d7b477b CloseHandle 64070->64074 64114 7ff73d7b4b20 64071->64114 64113 7ff73d7b5ffc 11 API calls 2 library calls 64072->64113 64074->64035 64079 7ff73d7b47af 64079->64074 64080->64034 64081->64037 64082->64039 64084 7ff73d7b488a 64083->64084 64085 7ff73d7b4947 64083->64085 64088 7ff73d7b48b6 GetFileInformationByHandle 64084->64088 64132 7ff73d7b4c5c 21 API calls _fread_nolock 64084->64132 64086 7ff73d7b4971 64085->64086 64087 7ff73d7b494f 64085->64087 64092 7ff73d7b4994 PeekNamedPipe 64086->64092 64107 7ff73d7b4932 64086->64107 64089 7ff73d7b4962 GetLastError 64087->64089 64090 7ff73d7b4953 64087->64090 64088->64089 64091 7ff73d7b48df 64088->64091 64135 7ff73d7b5ffc 11 API calls 2 library calls 64089->64135 64134 7ff73d7b6088 11 API calls _findclose 64090->64134 64095 7ff73d7b4b20 51 API calls 64091->64095 64092->64107 64097 7ff73d7b48ea 64095->64097 64125 7ff73d7b49e4 64097->64125 64098 7ff73d7aa100 _wfindfirst32i64 8 API calls 64101 7ff73d7b4774 64098->64101 64099 7ff73d7b48a4 64099->64088 64099->64107 64101->64069 64101->64070 64103 7ff73d7b49e4 10 API calls 64104 7ff73d7b4909 64103->64104 64105 7ff73d7b49e4 10 API calls 64104->64105 64106 7ff73d7b491a 64105->64106 64106->64107 64133 7ff73d7b6088 11 API calls _findclose 64106->64133 64107->64098 64109->64062 64110->64068 64112->64067 64113->64079 64116 7ff73d7b4b48 64114->64116 64115 7ff73d7b47dd 64124 7ff73d7b4c5c 21 API calls _fread_nolock 64115->64124 64116->64115 64136 7ff73d7be6f4 51 API calls 2 library calls 64116->64136 64118 7ff73d7b4bdc 64118->64115 64137 7ff73d7be6f4 51 API calls 2 library calls 64118->64137 64120 7ff73d7b4bef 64120->64115 64138 7ff73d7be6f4 51 API calls 2 library calls 64120->64138 64122 7ff73d7b4c02 64122->64115 64139 7ff73d7be6f4 51 API calls 2 library calls 64122->64139 64124->64079 64126 7ff73d7b4a00 64125->64126 64127 7ff73d7b4a0d FileTimeToSystemTime 64125->64127 64126->64127 64129 7ff73d7b4a08 64126->64129 64128 7ff73d7b4a21 SystemTimeToTzSpecificLocalTime 64127->64128 64127->64129 64128->64129 64130 7ff73d7aa100 _wfindfirst32i64 8 API calls 64129->64130 64131 7ff73d7b48f9 64130->64131 64131->64103 64132->64099 64133->64107 64134->64107 64135->64107 64136->64118 64137->64120 64138->64122 64139->64115 64141 7ff73d7a1bb6 64140->64141 64154 7ff73d7b3b5c 64141->64154 64143 7ff73d7a1bcc 64144 7ff73d7a1d00 64143->64144 64145 7ff73d7a1d10 64144->64145 64146 7ff73d7b3c80 49 API calls 64145->64146 64147 7ff73d7a1d58 64146->64147 64170 7ff73d7a6bf0 MultiByteToWideChar 64147->64170 64149 7ff73d7a1d70 64150 7ff73d7a1b90 78 API calls 64149->64150 64151 7ff73d7a1d9e 64150->64151 64152 7ff73d7aa100 _wfindfirst32i64 8 API calls 64151->64152 64153 7ff73d7a1c9b 64152->64153 64153->63462 64156 7ff73d7b3b86 64154->64156 64155 7ff73d7b3bbe 64168 7ff73d7b9e44 37 API calls 2 library calls 64155->64168 64156->64155 64158 7ff73d7b3bf1 64156->64158 64161 7ff73d7af140 64158->64161 64160 7ff73d7b3be7 64160->64143 64169 7ff73d7b438c EnterCriticalSection 64161->64169 64163 7ff73d7af15d 64164 7ff73d7b1084 76 API calls 64163->64164 64165 7ff73d7af166 64164->64165 64166 7ff73d7b4398 _fread_nolock LeaveCriticalSection 64165->64166 64167 7ff73d7af170 64166->64167 64167->64160 64168->64160 64171 7ff73d7a6c53 64170->64171 64172 7ff73d7a6c39 64170->64172 64174 7ff73d7a6c83 MultiByteToWideChar 64171->64174 64175 7ff73d7a6c69 64171->64175 64185 7ff73d7a1cb0 86 API calls 64172->64185 64177 7ff73d7a6cc0 WideCharToMultiByte 64174->64177 64178 7ff73d7a6ca6 64174->64178 64186 7ff73d7a1cb0 86 API calls 64175->64186 64180 7ff73d7a6cf6 64177->64180 64182 7ff73d7a6ced 64177->64182 64187 7ff73d7a1cb0 86 API calls 64178->64187 64181 7ff73d7a6d1b WideCharToMultiByte 64180->64181 64180->64182 64181->64182 64184 7ff73d7a6c4c __std_exception_destroy 64181->64184 64188 7ff73d7a1cb0 86 API calls 64182->64188 64184->64149 64185->64184 64186->64184 64187->64184 64188->64184 64190 7ff73d7b546c 64189->64190 64191 7ff73d7b5492 64190->64191 64194 7ff73d7b54c5 64190->64194 64220 7ff73d7b6088 11 API calls _findclose 64191->64220 64193 7ff73d7b5497 64221 7ff73d7b9f10 37 API calls _invalid_parameter_noinfo 64193->64221 64196 7ff73d7b54d8 64194->64196 64197 7ff73d7b54cb 64194->64197 64208 7ff73d7ba258 64196->64208 64222 7ff73d7b6088 11 API calls _findclose 64197->64222 64198 7ff73d7a2e39 64198->63630 64202 7ff73d7b54f9 64215 7ff73d7bf51c 64202->64215 64203 7ff73d7b54ec 64223 7ff73d7b6088 11 API calls _findclose 64203->64223 64206 7ff73d7b550c 64224 7ff73d7b4398 LeaveCriticalSection 64206->64224 64225 7ff73d7bf808 EnterCriticalSection 64208->64225 64210 7ff73d7ba26f 64211 7ff73d7ba2cc 19 API calls 64210->64211 64212 7ff73d7ba27a 64211->64212 64213 7ff73d7bf868 _isindst LeaveCriticalSection 64212->64213 64214 7ff73d7b54e2 64213->64214 64214->64202 64214->64203 64226 7ff73d7bf218 64215->64226 64218 7ff73d7bf576 64218->64206 64220->64193 64222->64198 64223->64198 64227 7ff73d7bf253 __vcrt_FlsAlloc 64226->64227 64236 7ff73d7bf41a 64227->64236 64241 7ff73d7c54f4 51 API calls 3 library calls 64227->64241 64229 7ff73d7bf4f1 64245 7ff73d7b9f10 37 API calls _invalid_parameter_noinfo 64229->64245 64231 7ff73d7bf423 64231->64218 64238 7ff73d7c61dc 64231->64238 64233 7ff73d7bf485 64233->64236 64242 7ff73d7c54f4 51 API calls 3 library calls 64233->64242 64235 7ff73d7bf4a4 64235->64236 64243 7ff73d7c54f4 51 API calls 3 library calls 64235->64243 64236->64231 64244 7ff73d7b6088 11 API calls _findclose 64236->64244 64246 7ff73d7c57dc 64238->64246 64241->64233 64242->64235 64243->64236 64244->64229 64247 7ff73d7c5811 64246->64247 64248 7ff73d7c57f3 64246->64248 64247->64248 64251 7ff73d7c582d 64247->64251 64300 7ff73d7b6088 11 API calls _findclose 64248->64300 64250 7ff73d7c57f8 64301 7ff73d7b9f10 37 API calls _invalid_parameter_noinfo 64250->64301 64257 7ff73d7c5dec 64251->64257 64254 7ff73d7c5804 64254->64218 64303 7ff73d7c5b20 64257->64303 64260 7ff73d7c5e61 64334 7ff73d7b6068 11 API calls _findclose 64260->64334 64261 7ff73d7c5e79 64322 7ff73d7b6e60 64261->64322 64265 7ff73d7c5e66 64335 7ff73d7b6088 11 API calls _findclose 64265->64335 64273 7ff73d7c5858 64273->64254 64302 7ff73d7b6e38 LeaveCriticalSection 64273->64302 64300->64250 64304 7ff73d7c5b4c 64303->64304 64307 7ff73d7c5b66 64303->64307 64304->64307 64347 7ff73d7b6088 11 API calls _findclose 64304->64347 64306 7ff73d7c5b5b 64348 7ff73d7b9f10 37 API calls _invalid_parameter_noinfo 64306->64348 64309 7ff73d7c5be4 64307->64309 64349 7ff73d7b6088 11 API calls _findclose 64307->64349 64310 7ff73d7c5c35 64309->64310 64351 7ff73d7b6088 11 API calls _findclose 64309->64351 64319 7ff73d7c5c92 64310->64319 64353 7ff73d7b57dc 37 API calls 2 library calls 64310->64353 64313 7ff73d7c5c8e 64313->64319 64320 7ff73d7b9f30 _wfindfirst32i64 17 API calls 64313->64320 64315 7ff73d7c5c2a 64352 7ff73d7b9f10 37 API calls _invalid_parameter_noinfo 64315->64352 64316 7ff73d7c5bd9 64350 7ff73d7b9f10 37 API calls _invalid_parameter_noinfo 64316->64350 64319->64260 64319->64261 64321 7ff73d7c5d25 64320->64321 64354 7ff73d7bf808 EnterCriticalSection 64322->64354 64334->64265 64335->64273 64347->64306 64349->64316 64351->64315 64353->64313 64356 7ff73d7b7acc 64355->64356 64359 7ff73d7b75a8 64356->64359 64358 7ff73d7b7ae5 64358->63640 64360 7ff73d7b75f2 64359->64360 64361 7ff73d7b75c3 64359->64361 64369 7ff73d7b438c EnterCriticalSection 64360->64369 64370 7ff73d7b9e44 37 API calls 2 library calls 64361->64370 64364 7ff73d7b75e3 64364->64358 64365 7ff73d7b75f7 64366 7ff73d7b7614 38 API calls 64365->64366 64367 7ff73d7b7603 64366->64367 64368 7ff73d7b4398 _fread_nolock LeaveCriticalSection 64367->64368 64368->64364 64370->64364 64372 7ff73d7ae431 64371->64372 64373 7ff73d7ae403 64371->64373 64375 7ff73d7ae423 64372->64375 64381 7ff73d7b438c EnterCriticalSection 64372->64381 64382 7ff73d7b9e44 37 API calls 2 library calls 64373->64382 64375->63644 64377 7ff73d7ae448 64378 7ff73d7ae464 72 API calls 64377->64378 64379 7ff73d7ae454 64378->64379 64380 7ff73d7b4398 _fread_nolock LeaveCriticalSection 64379->64380 64380->64375 64382->64375

                                                                                                                                                  Executed Functions

                                                                                                                                                  Function 00007FF73D7C4EA0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334timeCOMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  • Executed
                                                                                                                                                  • Not Executed
                                                                                                                                                  control_flow_graph 110 7ff73d7c4ea0-7ff73d7c4edb call 7ff73d7c4828 call 7ff73d7c4830 call 7ff73d7c4898 117 7ff73d7c4ee1-7ff73d7c4eec call 7ff73d7c4838 110->117 118 7ff73d7c5105-7ff73d7c5151 call 7ff73d7b9f30 call 7ff73d7c4828 call 7ff73d7c4830 call 7ff73d7c4898 110->118 117->118 123 7ff73d7c4ef2-7ff73d7c4efc 117->123 143 7ff73d7c528f-7ff73d7c52fd call 7ff73d7b9f30 call 7ff73d7c0738 118->143 144 7ff73d7c5157-7ff73d7c5162 call 7ff73d7c4838 118->144 125 7ff73d7c4f1e-7ff73d7c4f22 123->125 126 7ff73d7c4efe-7ff73d7c4f01 123->126 130 7ff73d7c4f25-7ff73d7c4f2d 125->130 128 7ff73d7c4f04-7ff73d7c4f0f 126->128 131 7ff73d7c4f11-7ff73d7c4f18 128->131 132 7ff73d7c4f1a-7ff73d7c4f1c 128->132 130->130 134 7ff73d7c4f2f-7ff73d7c4f42 call 7ff73d7bcc2c 130->134 131->128 131->132 132->125 135 7ff73d7c4f4b-7ff73d7c4f59 132->135 141 7ff73d7c4f44-7ff73d7c4f46 call 7ff73d7b9f78 134->141 142 7ff73d7c4f5a-7ff73d7c4f66 call 7ff73d7b9f78 134->142 141->135 150 7ff73d7c4f6d-7ff73d7c4f75 142->150 164 7ff73d7c52ff-7ff73d7c5306 143->164 165 7ff73d7c530b-7ff73d7c530e 143->165 144->143 155 7ff73d7c5168-7ff73d7c5173 call 7ff73d7c4868 144->155 150->150 154 7ff73d7c4f77-7ff73d7c4f88 call 7ff73d7bf9a4 150->154 154->118 163 7ff73d7c4f8e-7ff73d7c4fe4 call 7ff73d7ab880 * 4 call 7ff73d7c4dbc 154->163 155->143 162 7ff73d7c5179-7ff73d7c519c call 7ff73d7b9f78 GetTimeZoneInformation 155->162 176 7ff73d7c51a2-7ff73d7c51c3 162->176 177 7ff73d7c5264-7ff73d7c528e call 7ff73d7c4820 call 7ff73d7c4810 call 7ff73d7c4818 162->177 223 7ff73d7c4fe6-7ff73d7c4fea 163->223 168 7ff73d7c539b-7ff73d7c539e 164->168 169 7ff73d7c5310 165->169 170 7ff73d7c5345-7ff73d7c5358 call 7ff73d7bcc2c 165->170 172 7ff73d7c53a4-7ff73d7c53ac call 7ff73d7c4ea0 168->172 173 7ff73d7c5313 call 7ff73d7c511c 168->173 169->173 185 7ff73d7c5363-7ff73d7c537e call 7ff73d7c0738 170->185 186 7ff73d7c535a 170->186 189 7ff73d7c5318-7ff73d7c5344 call 7ff73d7b9f78 call 7ff73d7aa100 172->189 173->189 182 7ff73d7c51c5-7ff73d7c51cb 176->182 183 7ff73d7c51ce-7ff73d7c51d5 176->183 182->183 190 7ff73d7c51e9 183->190 191 7ff73d7c51d7-7ff73d7c51df 183->191 209 7ff73d7c5380-7ff73d7c5383 185->209 210 7ff73d7c5385-7ff73d7c5397 call 7ff73d7b9f78 185->210 192 7ff73d7c535c-7ff73d7c5361 call 7ff73d7b9f78 186->192 202 7ff73d7c51eb-7ff73d7c525f call 7ff73d7ab880 * 4 call 7ff73d7c1cfc call 7ff73d7c53b4 * 2 190->202 191->190 198 7ff73d7c51e1-7ff73d7c51e7 191->198 192->169 198->202 202->177 209->192 210->168 224 7ff73d7c4ff0-7ff73d7c4ff4 223->224 225 7ff73d7c4fec 223->225 224->223 227 7ff73d7c4ff6-7ff73d7c501b call 7ff73d7c7ce4 224->227 225->224 234 7ff73d7c501e-7ff73d7c5022 227->234 236 7ff73d7c5031-7ff73d7c5035 234->236 237 7ff73d7c5024-7ff73d7c502f 234->237 236->234 237->236 239 7ff73d7c5037-7ff73d7c503b 237->239 241 7ff73d7c503d-7ff73d7c5065 call 7ff73d7c7ce4 239->241 242 7ff73d7c50bc-7ff73d7c50c0 239->242 250 7ff73d7c5083-7ff73d7c5087 241->250 251 7ff73d7c5067 241->251 243 7ff73d7c50c2-7ff73d7c50c4 242->243 244 7ff73d7c50c7-7ff73d7c50d4 242->244 243->244 246 7ff73d7c50ef-7ff73d7c50fe call 7ff73d7c4820 call 7ff73d7c4810 244->246 247 7ff73d7c50d6-7ff73d7c50ec call 7ff73d7c4dbc 244->247 246->118 247->246 250->242 253 7ff73d7c5089-7ff73d7c50a7 call 7ff73d7c7ce4 250->253 255 7ff73d7c506a-7ff73d7c5071 251->255 262 7ff73d7c50b3-7ff73d7c50ba 253->262 255->250 258 7ff73d7c5073-7ff73d7c5081 255->258 258->250 258->255 262->242 263 7ff73d7c50a9-7ff73d7c50ad 262->263 263->242 264 7ff73d7c50af 263->264 264->262
                                                                                                                                                  APIs
                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF73D7C4EE5
                                                                                                                                                    • Part of subcall function 00007FF73D7C4838: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73D7C484C
                                                                                                                                                    • Part of subcall function 00007FF73D7B9F78: HeapFree.KERNEL32(?,?,?,00007FF73D7C1EC2,?,?,?,00007FF73D7C1EFF,?,?,00000000,00007FF73D7C23C5,?,?,00000000,00007FF73D7C22F7), ref: 00007FF73D7B9F8E
                                                                                                                                                    • Part of subcall function 00007FF73D7B9F78: GetLastError.KERNEL32(?,?,?,00007FF73D7C1EC2,?,?,?,00007FF73D7C1EFF,?,?,00000000,00007FF73D7C23C5,?,?,00000000,00007FF73D7C22F7), ref: 00007FF73D7B9F98
                                                                                                                                                    • Part of subcall function 00007FF73D7B9F30: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF73D7B9F0F,?,?,?,?,?,00007FF73D7B1A40), ref: 00007FF73D7B9F39
                                                                                                                                                    • Part of subcall function 00007FF73D7B9F30: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF73D7B9F0F,?,?,?,?,?,00007FF73D7B1A40), ref: 00007FF73D7B9F5E
                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF73D7C4ED4
                                                                                                                                                    • Part of subcall function 00007FF73D7C4898: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73D7C48AC
                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF73D7C514A
                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF73D7C515B
                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF73D7C516C
                                                                                                                                                  • GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF73D7C53AC), ref: 00007FF73D7C5193
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
                                                                                                                                                  • String ID: W. Europe Standard Time$W. Europe Summer Time
                                                                                                                                                  • API String ID: 4070488512-690618308
                                                                                                                                                  • Opcode ID: efd6bd86b0a9241ba49c40c51702d4a4216664c1cf6d90fa3e70e8402c69cba8
                                                                                                                                                  • Instruction ID: 563544c33dd6ba9be267295d8291dd0775ece5b0d61c173268cefaf4e0df071b
                                                                                                                                                  • Opcode Fuzzy Hash: efd6bd86b0a9241ba49c40c51702d4a4216664c1cf6d90fa3e70e8402c69cba8
                                                                                                                                                  • Instruction Fuzzy Hash: 06D1A222A1C25A6AE720BFB5D8501B9A6A1FF4C7A4FC44035EA8D47685FF3DF441E360
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7C5DEC Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  • Executed
                                                                                                                                                  • Not Executed
                                                                                                                                                  control_flow_graph 307 7ff73d7c5dec-7ff73d7c5e5f call 7ff73d7c5b20 310 7ff73d7c5e61-7ff73d7c5e6a call 7ff73d7b6068 307->310 311 7ff73d7c5e79-7ff73d7c5e83 call 7ff73d7b6e60 307->311 316 7ff73d7c5e6d-7ff73d7c5e74 call 7ff73d7b6088 310->316 317 7ff73d7c5e85-7ff73d7c5e9c call 7ff73d7b6068 call 7ff73d7b6088 311->317 318 7ff73d7c5e9e-7ff73d7c5f07 CreateFileW 311->318 331 7ff73d7c61ba-7ff73d7c61da 316->331 317->316 321 7ff73d7c5f84-7ff73d7c5f8f GetFileType 318->321 322 7ff73d7c5f09-7ff73d7c5f0f 318->322 326 7ff73d7c5fe2-7ff73d7c5fe9 321->326 327 7ff73d7c5f91-7ff73d7c5fcc GetLastError call 7ff73d7b5ffc CloseHandle 321->327 323 7ff73d7c5f51-7ff73d7c5f7f GetLastError call 7ff73d7b5ffc 322->323 324 7ff73d7c5f11-7ff73d7c5f15 322->324 323->316 324->323 329 7ff73d7c5f17-7ff73d7c5f4f CreateFileW 324->329 334 7ff73d7c5ff1-7ff73d7c5ff4 326->334 335 7ff73d7c5feb-7ff73d7c5fef 326->335 327->316 342 7ff73d7c5fd2-7ff73d7c5fdd call 7ff73d7b6088 327->342 329->321 329->323 339 7ff73d7c5ffa-7ff73d7c604f call 7ff73d7b6d78 334->339 340 7ff73d7c5ff6 334->340 335->339 345 7ff73d7c6051-7ff73d7c605d call 7ff73d7c5d28 339->345 346 7ff73d7c606e-7ff73d7c609f call 7ff73d7c58a0 339->346 340->339 342->316 345->346 352 7ff73d7c605f 345->352 353 7ff73d7c60a1-7ff73d7c60a3 346->353 354 7ff73d7c60a5-7ff73d7c60e7 346->354 355 7ff73d7c6061-7ff73d7c6069 call 7ff73d7ba0f0 352->355 353->355 356 7ff73d7c6109-7ff73d7c6114 354->356 357 7ff73d7c60e9-7ff73d7c60ed 354->357 355->331 359 7ff73d7c611a-7ff73d7c611e 356->359 360 7ff73d7c61b8 356->360 357->356 358 7ff73d7c60ef-7ff73d7c6104 357->358 358->356 359->360 362 7ff73d7c6124-7ff73d7c6169 CloseHandle CreateFileW 359->362 360->331 364 7ff73d7c619e-7ff73d7c61b3 362->364 365 7ff73d7c616b-7ff73d7c6199 GetLastError call 7ff73d7b5ffc call 7ff73d7b6fa0 362->365 364->360 365->364
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1617910340-0
                                                                                                                                                  • Opcode ID: 52a4378cdb78c32285671ba8c66096e739a338fe2dbd84037285ee5c330aca07
                                                                                                                                                  • Instruction ID: 05b991d51b8a46ce259d5d0b97b1bba063a714ceef46b3a785dfc098d738f835
                                                                                                                                                  • Opcode Fuzzy Hash: 52a4378cdb78c32285671ba8c66096e739a338fe2dbd84037285ee5c330aca07
                                                                                                                                                  • Instruction Fuzzy Hash: 36C1F432B28A4A9AEB10DFA4C4805AC7761F74DBA8F800235DE5E5B795EF39E051D310
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7C511C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  • Executed
                                                                                                                                                  • Not Executed
                                                                                                                                                  control_flow_graph 749 7ff73d7c511c-7ff73d7c5151 call 7ff73d7c4828 call 7ff73d7c4830 call 7ff73d7c4898 756 7ff73d7c528f-7ff73d7c52fd call 7ff73d7b9f30 call 7ff73d7c0738 749->756 757 7ff73d7c5157-7ff73d7c5162 call 7ff73d7c4838 749->757 769 7ff73d7c52ff-7ff73d7c5306 756->769 770 7ff73d7c530b-7ff73d7c530e 756->770 757->756 763 7ff73d7c5168-7ff73d7c5173 call 7ff73d7c4868 757->763 763->756 768 7ff73d7c5179-7ff73d7c519c call 7ff73d7b9f78 GetTimeZoneInformation 763->768 779 7ff73d7c51a2-7ff73d7c51c3 768->779 780 7ff73d7c5264-7ff73d7c528e call 7ff73d7c4820 call 7ff73d7c4810 call 7ff73d7c4818 768->780 772 7ff73d7c539b-7ff73d7c539e 769->772 773 7ff73d7c5310 770->773 774 7ff73d7c5345-7ff73d7c5358 call 7ff73d7bcc2c 770->774 776 7ff73d7c53a4-7ff73d7c53ac call 7ff73d7c4ea0 772->776 777 7ff73d7c5313 call 7ff73d7c511c 772->777 773->777 787 7ff73d7c5363-7ff73d7c537e call 7ff73d7c0738 774->787 788 7ff73d7c535a 774->788 790 7ff73d7c5318-7ff73d7c5344 call 7ff73d7b9f78 call 7ff73d7aa100 776->790 777->790 784 7ff73d7c51c5-7ff73d7c51cb 779->784 785 7ff73d7c51ce-7ff73d7c51d5 779->785 784->785 791 7ff73d7c51e9 785->791 792 7ff73d7c51d7-7ff73d7c51df 785->792 807 7ff73d7c5380-7ff73d7c5383 787->807 808 7ff73d7c5385-7ff73d7c5397 call 7ff73d7b9f78 787->808 793 7ff73d7c535c-7ff73d7c5361 call 7ff73d7b9f78 788->793 801 7ff73d7c51eb-7ff73d7c525f call 7ff73d7ab880 * 4 call 7ff73d7c1cfc call 7ff73d7c53b4 * 2 791->801 792->791 798 7ff73d7c51e1-7ff73d7c51e7 792->798 793->773 798->801 801->780 807->793 808->772
                                                                                                                                                  APIs
                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF73D7C514A
                                                                                                                                                    • Part of subcall function 00007FF73D7C4898: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73D7C48AC
                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF73D7C515B
                                                                                                                                                    • Part of subcall function 00007FF73D7C4838: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73D7C484C
                                                                                                                                                  • _get_daylight.LIBCMT ref: 00007FF73D7C516C
                                                                                                                                                    • Part of subcall function 00007FF73D7C4868: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73D7C487C
                                                                                                                                                    • Part of subcall function 00007FF73D7B9F78: HeapFree.KERNEL32(?,?,?,00007FF73D7C1EC2,?,?,?,00007FF73D7C1EFF,?,?,00000000,00007FF73D7C23C5,?,?,00000000,00007FF73D7C22F7), ref: 00007FF73D7B9F8E
                                                                                                                                                    • Part of subcall function 00007FF73D7B9F78: GetLastError.KERNEL32(?,?,?,00007FF73D7C1EC2,?,?,?,00007FF73D7C1EFF,?,?,00000000,00007FF73D7C23C5,?,?,00000000,00007FF73D7C22F7), ref: 00007FF73D7B9F98
                                                                                                                                                  • GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF73D7C53AC), ref: 00007FF73D7C5193
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
                                                                                                                                                  • String ID: W. Europe Standard Time$W. Europe Summer Time
                                                                                                                                                  • API String ID: 3458911817-690618308
                                                                                                                                                  • Opcode ID: 7e198542f45e47f797bfdedd3dcdeb77a56801e9e6762daf8462a5b391b5a0a3
                                                                                                                                                  • Instruction ID: dd971b74f90df43dbb840c2febaf66e860e90053ef6bbc71420a5751370b17d9
                                                                                                                                                  • Opcode Fuzzy Hash: 7e198542f45e47f797bfdedd3dcdeb77a56801e9e6762daf8462a5b391b5a0a3
                                                                                                                                                  • Instruction Fuzzy Hash: E8517132A1C64AAAE720FFA5D8901A9F760FB4C794FC04135EA8D47695EF3CF4009760
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF8A84FCDE0 Relevance: 6.8, APIs: 4, Instructions: 850librarymemoryloaderCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2442136726.00007FF8A84FC000.00000080.00000001.01000000.00000017.sdmp, Offset: 00007FF8A81B0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2441421471.00007FF8A81B0000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A81B1000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A81BD000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8215000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8229000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A823A000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8240000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A824D000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A83F6000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A83F8000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8423000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8454000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A847A000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A84C7000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A84CF000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A84EB000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A84F8000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2442165063.00007FF8A84FE000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff8a81b0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ProtectVirtual$AddressLibraryLoadProc
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3300690313-0
                                                                                                                                                  • Opcode ID: ae51d27ccbcf667624dac520b849d23daf3ade62aa54f1a4b469b13c076747e5
                                                                                                                                                  • Instruction ID: 64c6d2a7081258a878acb481a1cfef014de116b02505721c8dd8fa47b6128d54
                                                                                                                                                  • Opcode Fuzzy Hash: ae51d27ccbcf667624dac520b849d23daf3ade62aa54f1a4b469b13c076747e5
                                                                                                                                                  • Instruction Fuzzy Hash: 3A62482262A99296E7158F38D40037D7BA0F748BC5F045536EAAEC37C4EBBCEA45C714
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7A17B0 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 144COMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _fread_nolock$_invalid_parameter_noinfo
                                                                                                                                                  • String ID: Cannot read Table of Contents.$Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
                                                                                                                                                  • API String ID: 3405171723-4158440160
                                                                                                                                                  • Opcode ID: 99a95b783892b476e2a0d0c7f447c08d7c6dfec425a196ca4ac10a11762d1027
                                                                                                                                                  • Instruction ID: 253f66822e3f6f349930bf0b2bb80f4b459ad96d7b14b7d5bd94ffd4174cfa76
                                                                                                                                                  • Opcode Fuzzy Hash: 99a95b783892b476e2a0d0c7f447c08d7c6dfec425a196ca4ac10a11762d1027
                                                                                                                                                  • Instruction Fuzzy Hash: D9517D72A0DA0AA6EB54EF64D450178B3A0FB4CB58B918136DA4D87395EF3CF444D760
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7A12B0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 106COMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                  • API String ID: 0-3659356012
                                                                                                                                                  • Opcode ID: 1847f53e28831bf7bdad0349d54e91e27c7db2b272923d91413948859c691faf
                                                                                                                                                  • Instruction ID: 9727606b3beef95fbd1a7b1725d76c9eeacb80fa0a0033cfc6dc678c7798cf55
                                                                                                                                                  • Opcode Fuzzy Hash: 1847f53e28831bf7bdad0349d54e91e27c7db2b272923d91413948859c691faf
                                                                                                                                                  • Instruction Fuzzy Hash: 9A417F22B0CA4BA5FA14EB95A4002A9E3A0FB587D4FC54432DE4D47B45FF3CF545A320
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7A1000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 274COMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  • Executed
                                                                                                                                                  • Not Executed
                                                                                                                                                  control_flow_graph 433 7ff73d7a1000-7ff73d7a27b6 call 7ff73d7ae3e0 call 7ff73d7ae3d8 call 7ff73d7a67c0 call 7ff73d7aa130 call 7ff73d7b4310 call 7ff73d7b4f7c call 7ff73d7a1af0 449 7ff73d7a28ca 433->449 450 7ff73d7a27bc-7ff73d7a27cb call 7ff73d7a2cd0 433->450 451 7ff73d7a28cf-7ff73d7a28ef call 7ff73d7aa100 449->451 450->449 456 7ff73d7a27d1-7ff73d7a27e4 call 7ff73d7a2ba0 450->456 456->449 459 7ff73d7a27ea-7ff73d7a27fd call 7ff73d7a2c50 456->459 459->449 462 7ff73d7a2803-7ff73d7a282a call 7ff73d7a5af0 459->462 465 7ff73d7a286c-7ff73d7a2894 call 7ff73d7a60f0 call 7ff73d7a19d0 462->465 466 7ff73d7a282c-7ff73d7a283b call 7ff73d7a5af0 462->466 477 7ff73d7a289a-7ff73d7a28b0 call 7ff73d7a19d0 465->477 478 7ff73d7a297d-7ff73d7a298e 465->478 466->465 472 7ff73d7a283d-7ff73d7a2843 466->472 473 7ff73d7a284f-7ff73d7a2869 call 7ff73d7b4138 call 7ff73d7a60f0 472->473 474 7ff73d7a2845-7ff73d7a284d 472->474 473->465 474->473 490 7ff73d7a28f0-7ff73d7a28f3 477->490 491 7ff73d7a28b2-7ff73d7a28c5 call 7ff73d7a1c50 477->491 480 7ff73d7a2990-7ff73d7a299a call 7ff73d7a24a0 478->480 481 7ff73d7a29a3-7ff73d7a29bb call 7ff73d7a6db0 478->481 493 7ff73d7a299c 480->493 494 7ff73d7a29db-7ff73d7a29e8 call 7ff73d7a4fa0 480->494 495 7ff73d7a29ce-7ff73d7a29d5 SetDllDirectoryW 481->495 496 7ff73d7a29bd-7ff73d7a29c9 call 7ff73d7a1c50 481->496 490->478 492 7ff73d7a28f9-7ff73d7a2910 call 7ff73d7a2de0 490->492 491->449 506 7ff73d7a2912-7ff73d7a2915 492->506 507 7ff73d7a2917-7ff73d7a2943 call 7ff73d7a6360 492->507 493->481 504 7ff73d7a2a36-7ff73d7a2a3b call 7ff73d7a4f20 494->504 505 7ff73d7a29ea-7ff73d7a29fa call 7ff73d7a4c40 494->505 495->494 496->449 513 7ff73d7a2a40-7ff73d7a2a43 504->513 505->504 519 7ff73d7a29fc-7ff73d7a2a0b call 7ff73d7a47a0 505->519 510 7ff73d7a2952-7ff73d7a2968 call 7ff73d7a1c50 506->510 520 7ff73d7a2945-7ff73d7a294d call 7ff73d7ae60c 507->520 521 7ff73d7a296d-7ff73d7a297b 507->521 510->449 517 7ff73d7a2af6-7ff73d7a2afe call 7ff73d7a2330 513->517 518 7ff73d7a2a49-7ff73d7a2a56 513->518 529 7ff73d7a2b03-7ff73d7a2b05 517->529 522 7ff73d7a2a60-7ff73d7a2a6a 518->522 533 7ff73d7a2a2c-7ff73d7a2a31 call 7ff73d7a49f0 519->533 534 7ff73d7a2a0d-7ff73d7a2a19 call 7ff73d7a4730 519->534 520->510 521->480 526 7ff73d7a2a73-7ff73d7a2a75 522->526 527 7ff73d7a2a6c-7ff73d7a2a71 522->527 531 7ff73d7a2ac1-7ff73d7a2ad6 call 7ff73d7a2490 call 7ff73d7a22d0 call 7ff73d7a2480 526->531 532 7ff73d7a2a77-7ff73d7a2a9a call 7ff73d7a1b30 526->532 527->522 527->526 529->449 535 7ff73d7a2b0b-7ff73d7a2b42 call 7ff73d7a6080 call 7ff73d7a5af0 call 7ff73d7a4540 529->535 557 7ff73d7a2adb-7ff73d7a2af1 call 7ff73d7a49f0 call 7ff73d7a4f20 531->557 532->449 545 7ff73d7a2aa0-7ff73d7a2aab 532->545 533->504 534->533 546 7ff73d7a2a1b-7ff73d7a2a2a call 7ff73d7a4df0 534->546 535->449 558 7ff73d7a2b48-7ff73d7a2b7d call 7ff73d7a2490 call 7ff73d7a6130 call 7ff73d7a49f0 call 7ff73d7a4f20 535->558 550 7ff73d7a2ab0-7ff73d7a2abf 545->550 546->513 550->531 550->550 557->451 571 7ff73d7a2b7f-7ff73d7a2b82 call 7ff73d7a5df0 558->571 572 7ff73d7a2b87-7ff73d7a2b91 call 7ff73d7a1ab0 558->572 571->572 572->451
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 00007FF73D7A2CD0: GetModuleFileNameW.KERNEL32(?,00007FF73D7A27C9,?,?,?,?,?,?), ref: 00007FF73D7A2D01
                                                                                                                                                  • SetDllDirectoryW.KERNEL32 ref: 00007FF73D7A29D5
                                                                                                                                                    • Part of subcall function 00007FF73D7A5AF0: GetEnvironmentVariableW.KERNEL32(00007FF73D7A2817,?,?,?,?,?,?), ref: 00007FF73D7A5B2A
                                                                                                                                                    • Part of subcall function 00007FF73D7A5AF0: ExpandEnvironmentStringsW.KERNEL32(?,?,?,?,?,?), ref: 00007FF73D7A5B47
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
                                                                                                                                                  • String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
                                                                                                                                                  • API String ID: 2344891160-3602715111
                                                                                                                                                  • Opcode ID: 6ffaa7b6753284d36b7d0e83ed7552fa0ea6ef6719caab17f4e9f655f6ece649
                                                                                                                                                  • Instruction ID: aae7a1149a70466cd18f49eaeb528e6c347d95ae5c10e41ff3e59072bca909f3
                                                                                                                                                  • Opcode Fuzzy Hash: 6ffaa7b6753284d36b7d0e83ed7552fa0ea6ef6719caab17f4e9f655f6ece649
                                                                                                                                                  • Instruction Fuzzy Hash: B4C17222A1C68B75FA24BBA194512FDA391BF4C784FC05032EA4D47796FF2CF615A720
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7A1050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156COMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  • Executed
                                                                                                                                                  • Not Executed
                                                                                                                                                  control_flow_graph 576 7ff73d7a1050-7ff73d7a10ab call 7ff73d7a9990 579 7ff73d7a10d3-7ff73d7a10eb call 7ff73d7b414c 576->579 580 7ff73d7a10ad-7ff73d7a10d2 call 7ff73d7a1c50 576->580 585 7ff73d7a1109-7ff73d7a1119 call 7ff73d7b414c 579->585 586 7ff73d7a10ed-7ff73d7a1104 call 7ff73d7a1c10 579->586 592 7ff73d7a1137-7ff73d7a1147 585->592 593 7ff73d7a111b-7ff73d7a1132 call 7ff73d7a1c10 585->593 591 7ff73d7a126c-7ff73d7a12a0 call 7ff73d7a9670 call 7ff73d7b4138 * 2 586->591 594 7ff73d7a1150-7ff73d7a116d call 7ff73d7ae95c 592->594 593->591 600 7ff73d7a1172-7ff73d7a1175 594->600 602 7ff73d7a117b-7ff73d7a1185 call 7ff73d7ae6d0 600->602 603 7ff73d7a125e 600->603 602->603 610 7ff73d7a118b-7ff73d7a1197 602->610 605 7ff73d7a1264 603->605 605->591 611 7ff73d7a11a0-7ff73d7a11c8 call 7ff73d7a7de0 610->611 614 7ff73d7a1241-7ff73d7a125c call 7ff73d7a1c50 611->614 615 7ff73d7a11ca-7ff73d7a11cd 611->615 614->605 616 7ff73d7a11cf-7ff73d7a11d9 615->616 617 7ff73d7a123c 615->617 620 7ff73d7a1203-7ff73d7a1206 616->620 621 7ff73d7a11db-7ff73d7a11f0 call 7ff73d7af09c 616->621 617->614 622 7ff73d7a1208-7ff73d7a1216 call 7ff73d7aaec0 620->622 623 7ff73d7a1219-7ff73d7a121e 620->623 628 7ff73d7a11f2-7ff73d7a11fc call 7ff73d7ae6d0 621->628 629 7ff73d7a11fe-7ff73d7a1201 621->629 622->623 623->611 626 7ff73d7a1220-7ff73d7a1223 623->626 631 7ff73d7a1225-7ff73d7a1228 626->631 632 7ff73d7a1237-7ff73d7a123a 626->632 628->623 628->629 629->614 631->614 634 7ff73d7a122a-7ff73d7a1232 631->634 632->605 634->594
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID: 1.2.13$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                                                  • API String ID: 0-1655038675
                                                                                                                                                  • Opcode ID: ad1d5c708e0e1f1d3b9565d7782decd6f7c4dfa5a4b923ce9d46d716d778b2b5
                                                                                                                                                  • Instruction ID: 5f2d5940081e6786cb7d0821df9bfca7ea7bf0fda4bddac639a9ad2d30221019
                                                                                                                                                  • Opcode Fuzzy Hash: ad1d5c708e0e1f1d3b9565d7782decd6f7c4dfa5a4b923ce9d46d716d778b2b5
                                                                                                                                                  • Instruction Fuzzy Hash: 64518022A0D68AA5FA60BB91E4403B9A291BB88794FC44135DE4D877C5FF3CF549E720
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BB08C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  • Executed
                                                                                                                                                  • Not Executed
                                                                                                                                                  control_flow_graph 636 7ff73d7bb08c-7ff73d7bb0b2 637 7ff73d7bb0b4-7ff73d7bb0c8 call 7ff73d7b6068 call 7ff73d7b6088 636->637 638 7ff73d7bb0cd-7ff73d7bb0d1 636->638 652 7ff73d7bb4be 637->652 639 7ff73d7bb4a7-7ff73d7bb4b3 call 7ff73d7b6068 call 7ff73d7b6088 638->639 640 7ff73d7bb0d7-7ff73d7bb0de 638->640 659 7ff73d7bb4b9 call 7ff73d7b9f10 639->659 640->639 642 7ff73d7bb0e4-7ff73d7bb112 640->642 642->639 645 7ff73d7bb118-7ff73d7bb11f 642->645 649 7ff73d7bb121-7ff73d7bb133 call 7ff73d7b6068 call 7ff73d7b6088 645->649 650 7ff73d7bb138-7ff73d7bb13b 645->650 649->659 655 7ff73d7bb141-7ff73d7bb147 650->655 656 7ff73d7bb4a3-7ff73d7bb4a5 650->656 657 7ff73d7bb4c1-7ff73d7bb4d8 652->657 655->656 660 7ff73d7bb14d-7ff73d7bb150 655->660 656->657 659->652 660->649 663 7ff73d7bb152-7ff73d7bb177 660->663 665 7ff73d7bb1aa-7ff73d7bb1b1 663->665 666 7ff73d7bb179-7ff73d7bb17b 663->666 667 7ff73d7bb186-7ff73d7bb19d call 7ff73d7b6068 call 7ff73d7b6088 call 7ff73d7b9f10 665->667 668 7ff73d7bb1b3-7ff73d7bb1db call 7ff73d7bcc2c call 7ff73d7b9f78 * 2 665->668 669 7ff73d7bb1a2-7ff73d7bb1a8 666->669 670 7ff73d7bb17d-7ff73d7bb184 666->670 700 7ff73d7bb330 667->700 696 7ff73d7bb1f8-7ff73d7bb223 call 7ff73d7bb8b4 668->696 697 7ff73d7bb1dd-7ff73d7bb1f3 call 7ff73d7b6088 call 7ff73d7b6068 668->697 672 7ff73d7bb228-7ff73d7bb23f 669->672 670->667 670->669 675 7ff73d7bb241-7ff73d7bb249 672->675 676 7ff73d7bb2ba-7ff73d7bb2c4 call 7ff73d7c2abc 672->676 675->676 680 7ff73d7bb24b-7ff73d7bb24d 675->680 687 7ff73d7bb2ca-7ff73d7bb2df 676->687 688 7ff73d7bb34e 676->688 680->676 684 7ff73d7bb24f-7ff73d7bb265 680->684 684->676 689 7ff73d7bb267-7ff73d7bb273 684->689 687->688 693 7ff73d7bb2e1-7ff73d7bb2f3 GetConsoleMode 687->693 691 7ff73d7bb353-7ff73d7bb373 ReadFile 688->691 689->676 694 7ff73d7bb275-7ff73d7bb277 689->694 698 7ff73d7bb379-7ff73d7bb381 691->698 699 7ff73d7bb46d-7ff73d7bb476 GetLastError 691->699 693->688 701 7ff73d7bb2f5-7ff73d7bb2fd 693->701 694->676 702 7ff73d7bb279-7ff73d7bb291 694->702 696->672 697->700 698->699 704 7ff73d7bb387 698->704 707 7ff73d7bb493-7ff73d7bb496 699->707 708 7ff73d7bb478-7ff73d7bb48e call 7ff73d7b6088 call 7ff73d7b6068 699->708 709 7ff73d7bb333-7ff73d7bb33d call 7ff73d7b9f78 700->709 701->691 706 7ff73d7bb2ff-7ff73d7bb321 ReadConsoleW 701->706 702->676 710 7ff73d7bb293-7ff73d7bb29f 702->710 715 7ff73d7bb38e-7ff73d7bb3a3 704->715 717 7ff73d7bb342-7ff73d7bb34c 706->717 718 7ff73d7bb323 GetLastError 706->718 712 7ff73d7bb329-7ff73d7bb32b call 7ff73d7b5ffc 707->712 713 7ff73d7bb49c-7ff73d7bb49e 707->713 708->700 709->657 710->676 711 7ff73d7bb2a1-7ff73d7bb2a3 710->711 711->676 721 7ff73d7bb2a5-7ff73d7bb2b5 711->721 712->700 713->709 715->709 723 7ff73d7bb3a5-7ff73d7bb3b0 715->723 717->715 718->712 721->676 728 7ff73d7bb3b2-7ff73d7bb3cb call 7ff73d7baca4 723->728 729 7ff73d7bb3d7-7ff73d7bb3df 723->729 736 7ff73d7bb3d0-7ff73d7bb3d2 728->736 732 7ff73d7bb3e1-7ff73d7bb3f3 729->732 733 7ff73d7bb45b-7ff73d7bb468 call 7ff73d7baae4 729->733 737 7ff73d7bb3f5 732->737 738 7ff73d7bb44e-7ff73d7bb456 732->738 733->736 736->709 740 7ff73d7bb3fa-7ff73d7bb401 737->740 738->709 741 7ff73d7bb403-7ff73d7bb407 740->741 742 7ff73d7bb43d-7ff73d7bb448 740->742 743 7ff73d7bb423 741->743 744 7ff73d7bb409-7ff73d7bb410 741->744 742->738 746 7ff73d7bb429-7ff73d7bb439 743->746 744->743 745 7ff73d7bb412-7ff73d7bb416 744->745 745->743 747 7ff73d7bb418-7ff73d7bb421 745->747 746->740 748 7ff73d7bb43b 746->748 747->746 748->738
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                  • Opcode ID: 6ace3fbad8ddd1cd05ed41dddf3a6c6a2c6962649ba5052cc4813f441b9b9292
                                                                                                                                                  • Instruction ID: 4abb210d8458dfb35c3cc1d39a417f16e737bf044167b41653809584b7eae96f
                                                                                                                                                  • Opcode Fuzzy Hash: 6ace3fbad8ddd1cd05ed41dddf3a6c6a2c6962649ba5052cc4813f441b9b9292
                                                                                                                                                  • Instruction Fuzzy Hash: 7BC1082290C64E61E722AB9594482BDB751FBA9B80FD50131EE8D07791EF7CF449E320
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BC590 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  • Executed
                                                                                                                                                  • Not Executed
                                                                                                                                                  control_flow_graph 1034 7ff73d7bc590-7ff73d7bc5b5 1035 7ff73d7bc883 1034->1035 1036 7ff73d7bc5bb-7ff73d7bc5be 1034->1036 1039 7ff73d7bc885-7ff73d7bc895 1035->1039 1037 7ff73d7bc5c0-7ff73d7bc5f2 call 7ff73d7b9e44 1036->1037 1038 7ff73d7bc5f7-7ff73d7bc623 1036->1038 1037->1039 1041 7ff73d7bc625-7ff73d7bc62c 1038->1041 1042 7ff73d7bc62e-7ff73d7bc634 1038->1042 1041->1037 1041->1042 1044 7ff73d7bc636-7ff73d7bc63f call 7ff73d7bb950 1042->1044 1045 7ff73d7bc644-7ff73d7bc659 call 7ff73d7c2abc 1042->1045 1044->1045 1049 7ff73d7bc65f-7ff73d7bc668 1045->1049 1050 7ff73d7bc773-7ff73d7bc77c 1045->1050 1049->1050 1053 7ff73d7bc66e-7ff73d7bc672 1049->1053 1051 7ff73d7bc7d0-7ff73d7bc7f5 WriteFile 1050->1051 1052 7ff73d7bc77e-7ff73d7bc784 1050->1052 1054 7ff73d7bc800 1051->1054 1055 7ff73d7bc7f7-7ff73d7bc7fd GetLastError 1051->1055 1056 7ff73d7bc786-7ff73d7bc789 1052->1056 1057 7ff73d7bc7bc-7ff73d7bc7c9 call 7ff73d7bc048 1052->1057 1058 7ff73d7bc674-7ff73d7bc67c call 7ff73d7b3830 1053->1058 1059 7ff73d7bc683-7ff73d7bc68e 1053->1059 1064 7ff73d7bc803 1054->1064 1055->1054 1065 7ff73d7bc7a8-7ff73d7bc7ba call 7ff73d7bc268 1056->1065 1066 7ff73d7bc78b-7ff73d7bc78e 1056->1066 1071 7ff73d7bc7ce 1057->1071 1058->1059 1061 7ff73d7bc690-7ff73d7bc699 1059->1061 1062 7ff73d7bc69f-7ff73d7bc6b4 GetConsoleMode 1059->1062 1061->1050 1061->1062 1069 7ff73d7bc6ba-7ff73d7bc6c0 1062->1069 1070 7ff73d7bc76c 1062->1070 1072 7ff73d7bc808 1064->1072 1078 7ff73d7bc760-7ff73d7bc767 1065->1078 1073 7ff73d7bc814-7ff73d7bc81e 1066->1073 1074 7ff73d7bc794-7ff73d7bc7a6 call 7ff73d7bc14c 1066->1074 1076 7ff73d7bc6c6-7ff73d7bc6c9 1069->1076 1077 7ff73d7bc749-7ff73d7bc75b call 7ff73d7bbbd0 1069->1077 1070->1050 1071->1078 1079 7ff73d7bc80d 1072->1079 1080 7ff73d7bc820-7ff73d7bc825 1073->1080 1081 7ff73d7bc87c-7ff73d7bc881 1073->1081 1074->1078 1084 7ff73d7bc6d4-7ff73d7bc6e2 1076->1084 1085 7ff73d7bc6cb-7ff73d7bc6ce 1076->1085 1077->1078 1078->1072 1079->1073 1087 7ff73d7bc853-7ff73d7bc85d 1080->1087 1088 7ff73d7bc827-7ff73d7bc82a 1080->1088 1081->1039 1093 7ff73d7bc740-7ff73d7bc744 1084->1093 1094 7ff73d7bc6e4 1084->1094 1085->1079 1085->1084 1091 7ff73d7bc85f-7ff73d7bc862 1087->1091 1092 7ff73d7bc864-7ff73d7bc873 1087->1092 1089 7ff73d7bc843-7ff73d7bc84e call 7ff73d7b6044 1088->1089 1090 7ff73d7bc82c-7ff73d7bc83b 1088->1090 1089->1087 1090->1089 1091->1035 1091->1092 1092->1081 1093->1064 1096 7ff73d7bc6e8-7ff73d7bc6ff call 7ff73d7c2b88 1094->1096 1100 7ff73d7bc701-7ff73d7bc70d 1096->1100 1101 7ff73d7bc737-7ff73d7bc73d GetLastError 1096->1101 1102 7ff73d7bc70f-7ff73d7bc721 call 7ff73d7c2b88 1100->1102 1103 7ff73d7bc72c-7ff73d7bc733 1100->1103 1101->1093 1102->1101 1107 7ff73d7bc723-7ff73d7bc72a 1102->1107 1103->1093 1104 7ff73d7bc735 1103->1104 1104->1096 1107->1103
                                                                                                                                                  APIs
                                                                                                                                                  • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF73D7BC57B), ref: 00007FF73D7BC6AC
                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF73D7BC57B), ref: 00007FF73D7BC737
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ConsoleErrorLastMode
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 953036326-0
                                                                                                                                                  • Opcode ID: 1ee269c4fb3492fdab786e16ea0be33da994e1b3a3006f3c14cd8905a42bf150
                                                                                                                                                  • Instruction ID: 14713b6ca5f96d38d89900a7ab2817049fe3ee9c0c1074ee1b6d9d1dcfad9830
                                                                                                                                                  • Opcode Fuzzy Hash: 1ee269c4fb3492fdab786e16ea0be33da994e1b3a3006f3c14cd8905a42bf150
                                                                                                                                                  • Instruction Fuzzy Hash: D391C832E0C65AA5F750AFB5944027DA7A0FB68B88F948139EE4E57684EF38F441D720
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BE95C Relevance: 6.2, APIs: 4, Instructions: 162COMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  • Executed
                                                                                                                                                  • Not Executed
                                                                                                                                                  control_flow_graph 1108 7ff73d7be95c-7ff73d7be998 1109 7ff73d7beb4e-7ff73d7beb59 call 7ff73d7b6088 1108->1109 1110 7ff73d7be99e-7ff73d7be9a7 1108->1110 1116 7ff73d7beb5d-7ff73d7beb79 call 7ff73d7aa100 1109->1116 1110->1109 1111 7ff73d7be9ad-7ff73d7be9b6 1110->1111 1111->1109 1113 7ff73d7be9bc-7ff73d7be9bf 1111->1113 1113->1109 1115 7ff73d7be9c5-7ff73d7be9d6 1113->1115 1117 7ff73d7bea00-7ff73d7bea04 1115->1117 1118 7ff73d7be9d8-7ff73d7be9e1 call 7ff73d7be900 1115->1118 1117->1109 1122 7ff73d7bea0a-7ff73d7bea0e 1117->1122 1118->1109 1125 7ff73d7be9e7-7ff73d7be9ea 1118->1125 1122->1109 1124 7ff73d7bea14-7ff73d7bea18 1122->1124 1124->1109 1126 7ff73d7bea1e-7ff73d7bea2e call 7ff73d7be900 1124->1126 1125->1109 1127 7ff73d7be9f0-7ff73d7be9f3 1125->1127 1131 7ff73d7bea30-7ff73d7bea33 1126->1131 1132 7ff73d7bea37 call 7ff73d7c5434 1126->1132 1127->1109 1130 7ff73d7be9f9 1127->1130 1130->1117 1131->1132 1133 7ff73d7bea35 1131->1133 1135 7ff73d7bea3c-7ff73d7bea53 call 7ff73d7c4838 1132->1135 1133->1132 1138 7ff73d7beb7a-7ff73d7beb8f call 7ff73d7b9f30 1135->1138 1139 7ff73d7bea59-7ff73d7bea64 call 7ff73d7c4868 1135->1139 1139->1138 1144 7ff73d7bea6a-7ff73d7bea75 call 7ff73d7c4898 1139->1144 1144->1138 1147 7ff73d7bea7b-7ff73d7beb0f 1144->1147 1148 7ff73d7beb11-7ff73d7beb2d 1147->1148 1149 7ff73d7beb49-7ff73d7beb4c 1147->1149 1150 7ff73d7beb2f-7ff73d7beb33 1148->1150 1151 7ff73d7beb44-7ff73d7beb47 1148->1151 1149->1116 1150->1151 1152 7ff73d7beb35-7ff73d7beb40 call 7ff73d7c5478 1150->1152 1151->1116 1152->1151
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _get_daylight$_isindst
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 4170891091-0
                                                                                                                                                  • Opcode ID: 993f4cb53d01987759aa9ab87d439edc94425a62c6450610c4994d1423bcdf7f
                                                                                                                                                  • Instruction ID: 023e201b58abf58582f42327d4877943cc7836e36954433d4f003d84484bc9ea
                                                                                                                                                  • Opcode Fuzzy Hash: 993f4cb53d01987759aa9ab87d439edc94425a62c6450610c4994d1423bcdf7f
                                                                                                                                                  • Instruction Fuzzy Hash: 0D516972F182195AFB18EFA4D851ABDA7A1AB28358F940135DD1F47BD0EF38B501DB00
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7B483C Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2780335769-0
                                                                                                                                                  • Opcode ID: 81de7022a69b47ce39b5392d1784fece2718e2d2aab2765227a8e407644b98c7
                                                                                                                                                  • Instruction ID: c91557c8b89d67a92f2a11b696a4683178425248f3c64a72bb04d1c15936d844
                                                                                                                                                  • Opcode Fuzzy Hash: 81de7022a69b47ce39b5392d1784fece2718e2d2aab2765227a8e407644b98c7
                                                                                                                                                  • Instruction Fuzzy Hash: 7A51BD22E0C646AAFB10EFB0D4503BDA3A1BB5CB5CF908035DE4D57689EF38E4859760
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7B46E8 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1279662727-0
                                                                                                                                                  • Opcode ID: 58b178a13046118a9aa3eab3ad0445e857bf873c1952e3e12f7b4cc56e3b75ff
                                                                                                                                                  • Instruction ID: b568f7dd7fe2386bbbe20592a6efc1d613a31154cc1a92507e02d4342b02cb30
                                                                                                                                                  • Opcode Fuzzy Hash: 58b178a13046118a9aa3eab3ad0445e857bf873c1952e3e12f7b4cc56e3b75ff
                                                                                                                                                  • Instruction Fuzzy Hash: 7041C222D1C78597E710ABA09510379B360FBA97A8F908334E79C03AD1EF7CB4E09720
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7AA51C Relevance: 4.6, APIs: 3, Instructions: 102COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3058843127-0
                                                                                                                                                  • Opcode ID: 0a8c62a57e2cf59f1561fe537eeb51f2220189f8d74725526a3d26dbeb988a7e
                                                                                                                                                  • Instruction ID: 6506bc38d70cf4cf3ba8cc93d4fa138e899af3dbc8c4ce6f4be12d8257933380
                                                                                                                                                  • Opcode Fuzzy Hash: 0a8c62a57e2cf59f1561fe537eeb51f2220189f8d74725526a3d26dbeb988a7e
                                                                                                                                                  • Instruction Fuzzy Hash: 14313821E0C28AA6EA54BBE0D4123BAA291BF4D784FC44435EA4D47393FF2CB445A770
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7B89E8 Relevance: 4.5, APIs: 3, Instructions: 14COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Process$CurrentExitTerminate
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1703294689-0
                                                                                                                                                  • Opcode ID: fc68bfbf785dc4e8d02d30f22ac316467e06faf73d836825e3014864920bd8dd
                                                                                                                                                  • Instruction ID: 59741308a5176c070f84cd34da3ad558a5030ab20cd00259ed85331e3fffd813
                                                                                                                                                  • Opcode Fuzzy Hash: fc68bfbf785dc4e8d02d30f22ac316467e06faf73d836825e3014864920bd8dd
                                                                                                                                                  • Instruction Fuzzy Hash: 03D09E10B0C64AAAEB543BF1585917992516F9C762F841438C88F17393FF3DB84D6270
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7AE6FC Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                  • Opcode ID: 91f838de0bf1c0634cfb639a0c406c35748c40ae1573d712d08faa75350ec251
                                                                                                                                                  • Instruction ID: bf5cefecd58a8824fbe5ff991beb8f0fcafe1351405de923383375ec2ea08358
                                                                                                                                                  • Opcode Fuzzy Hash: 91f838de0bf1c0634cfb639a0c406c35748c40ae1573d712d08faa75350ec251
                                                                                                                                                  • Instruction Fuzzy Hash: F2510921F2D25A56F768BAA5940067AE181BF48BB4F884634DD7C077C5EF3CF401A721
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BC048 Relevance: 3.1, APIs: 2, Instructions: 74fileCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ErrorFileLastWrite
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 442123175-0
                                                                                                                                                  • Opcode ID: 48497a76b3055afe52661005fd715ce1d46b06a16acad2e21dfde3d81f02aed8
                                                                                                                                                  • Instruction ID: 9bafce91676fc5c94e093fe903c661060f26a86cce37ab452474dceaacc26843
                                                                                                                                                  • Opcode Fuzzy Hash: 48497a76b3055afe52661005fd715ce1d46b06a16acad2e21dfde3d81f02aed8
                                                                                                                                                  • Instruction Fuzzy Hash: 2831B47261CA89AADB50AF65E8402A9B760FB5C780FC48032EB8D83755FF3CE555D720
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BBA48 Relevance: 3.1, APIs: 2, Instructions: 71COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: FileHandleType
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3000768030-0
                                                                                                                                                  • Opcode ID: 51d66a3ea3a1e5720d3031fa8d01ef1f6d3b4a26eee4bfd04239a76c9c1293a5
                                                                                                                                                  • Instruction ID: 9e6f93e8bea8158b100c1ce2930ce8726f03d36fd446219f97fea8e789d363b3
                                                                                                                                                  • Opcode Fuzzy Hash: 51d66a3ea3a1e5720d3031fa8d01ef1f6d3b4a26eee4bfd04239a76c9c1293a5
                                                                                                                                                  • Instruction Fuzzy Hash: D931D622E1CB4AA1D7219B548584179AA50FB5DBB0FA81339EF6E073E4DF38F491E310
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BA188 Relevance: 3.1, APIs: 2, Instructions: 59COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • FindCloseChangeNotification.KERNEL32(?,?,?,00007FF73D7BA005,?,?,00000000,00007FF73D7BA0BA), ref: 00007FF73D7BA1F6
                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,00007FF73D7BA005,?,?,00000000,00007FF73D7BA0BA), ref: 00007FF73D7BA200
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ChangeCloseErrorFindLastNotification
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1687624791-0
                                                                                                                                                  • Opcode ID: 6fe57093fbbb00cdf8389479e1e18e52ea82cce6ea34632ee61e1d7ac301845a
                                                                                                                                                  • Instruction ID: 720975984a31862dbd6b806d2a14fb68b46e1fa4ba664aa7d704bd5eb6163b4c
                                                                                                                                                  • Opcode Fuzzy Hash: 6fe57093fbbb00cdf8389479e1e18e52ea82cce6ea34632ee61e1d7ac301845a
                                                                                                                                                  • Instruction Fuzzy Hash: CD219511B1C64A61FE9077D194902BD96A1AFAC7A0FC45235DA6D473C5FFACB4446310
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BB764 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • SetFilePointerEx.KERNEL32(?,?,?,?,?,00007FF73D7BB750,00000000,?,?,?,00007FF73D7A1023,00007FF73D7BB859), ref: 00007FF73D7BB7B0
                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,?,?,00007FF73D7BB750,00000000,?,?,?,00007FF73D7A1023,00007FF73D7BB859), ref: 00007FF73D7BB7BA
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ErrorFileLastPointer
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2976181284-0
                                                                                                                                                  • Opcode ID: 7196098b30ecd42809471233c9619b7315c9fb41ce716e28bdee8d0b35162eb6
                                                                                                                                                  • Instruction ID: 9fe5712ef25d82b8c6fa35a5e7df89dc56d11b8ad7af2cc24ee1ba12a60ebebc
                                                                                                                                                  • Opcode Fuzzy Hash: 7196098b30ecd42809471233c9619b7315c9fb41ce716e28bdee8d0b35162eb6
                                                                                                                                                  • Instruction Fuzzy Hash: 0D11272270CB8691DA10AB66A408069E361FB58BF0FD44332EEBD0B7D8EF7CE0408700
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7B49E4 Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF73D7B48F9), ref: 00007FF73D7B4A17
                                                                                                                                                  • SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF73D7B48F9), ref: 00007FF73D7B4A2D
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Time$System$FileLocalSpecific
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1707611234-0
                                                                                                                                                  • Opcode ID: 5359c6eadbc125880de5eb3a516e79e0ad43a75e61374d6be107f92d83a7530b
                                                                                                                                                  • Instruction ID: a9c5d0952685bd83c920b09168faec54f74208da43ecec94c1811ad3dc48a682
                                                                                                                                                  • Opcode Fuzzy Hash: 5359c6eadbc125880de5eb3a516e79e0ad43a75e61374d6be107f92d83a7530b
                                                                                                                                                  • Instruction Fuzzy Hash: 7D11A77260C65691EB54AB60A41113BF7A0FB98779F900235F6AE81AD4FF3CE054EB10
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BB4DC Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                  • Opcode ID: 3cb10c43647639a768565940e1ce5c449de1869fbc1a92892aa118bde093882e
                                                                                                                                                  • Instruction ID: 517d932d23769ba1c459684f826121b752213ba741d90c28d5b1a8ffb3eb48fe
                                                                                                                                                  • Opcode Fuzzy Hash: 3cb10c43647639a768565940e1ce5c449de1869fbc1a92892aa118bde093882e
                                                                                                                                                  • Instruction Fuzzy Hash: 0941F53290C64997EA35EB99A545179F3A0EF7AB44F940131DA8E836D0EF2CF402D761
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7A6360 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _fread_nolock
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 840049012-0
                                                                                                                                                  • Opcode ID: 1ebe73e79a88a8d1e8c37e7947aa95229b0cab0f74217ed01c060248211f59ac
                                                                                                                                                  • Instruction ID: ff08a9ade6575cdb7e99cc50919c6722b45082b43a1caf98e1b5ae9141df743e
                                                                                                                                                  • Opcode Fuzzy Hash: 1ebe73e79a88a8d1e8c37e7947aa95229b0cab0f74217ed01c060248211f59ac
                                                                                                                                                  • Instruction Fuzzy Hash: A421A221B1CA9A66EA24BB9269043BEE651BF49BC4FC84430EE0C07786EF3CF1459610
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BAF6C Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                  • Opcode ID: 215bf1b77ccde561eed8eea60c34a1d65fc1379a1c4c4c23abd8e86c97fd8e23
                                                                                                                                                  • Instruction ID: 775eefcb58c7010862e085f5705da31cf3a6f26b1618e4c8eb30da5033f83ba6
                                                                                                                                                  • Opcode Fuzzy Hash: 215bf1b77ccde561eed8eea60c34a1d65fc1379a1c4c4c23abd8e86c97fd8e23
                                                                                                                                                  • Instruction Fuzzy Hash: 0931C561A1C60AA5E7217BD684403BCAA50BB6DB50FC10135EA9D073D2EFBCF446A330
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7B8919 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: HandleModule$AddressFreeLibraryProc
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3947729631-0
                                                                                                                                                  • Opcode ID: 7474e071a48ef7130f5acd4d7b35ddfbaeb0d66e7037ac086cf5d56d8c80b409
                                                                                                                                                  • Instruction ID: 775c63a974944b002aef68a48c7381feda699859f858bcbbc337567a8d685faf
                                                                                                                                                  • Opcode Fuzzy Hash: 7474e071a48ef7130f5acd4d7b35ddfbaeb0d66e7037ac086cf5d56d8c80b409
                                                                                                                                                  • Instruction Fuzzy Hash: 3C21A172E0870A9AEB24AFA4C4442FC77B0EB18718F881636D65D06AC5EF38E444D7A1
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7B5538 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                  • Opcode ID: 25f020cec256df429067bb606d051891f0f83e0bb8faa834007163ccabd97c9c
                                                                                                                                                  • Instruction ID: e174bde111b7000417c003b7b92e9001e6ad9bc835f14afad58af2176a201aec
                                                                                                                                                  • Opcode Fuzzy Hash: 25f020cec256df429067bb606d051891f0f83e0bb8faa834007163ccabd97c9c
                                                                                                                                                  • Instruction Fuzzy Hash: A0118121A1C64991EA60BF91940127DE260FFA9BC0FC84431EB8C57A86EF7DF8016760
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7C57DC Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                  • Opcode ID: e860bb9bc84c29a06dccfc010b7eb52daf61d2c250f48aeb7393b4a8ace16f10
                                                                                                                                                  • Instruction ID: f8ca7ac263bc340faa61b88183489ee1a67271bb09b8e842157e9f26a7616a4d
                                                                                                                                                  • Opcode Fuzzy Hash: e860bb9bc84c29a06dccfc010b7eb52daf61d2c250f48aeb7393b4a8ace16f10
                                                                                                                                                  • Instruction Fuzzy Hash: 2A21D732A1CA459BDB61AF58D440379B6A0FB88BA4FD44234E79D476D9EF3DE4009B10
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7AE97C Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3215553584-0
                                                                                                                                                  • Opcode ID: 298f7b2a666c55937c0a4044f00fb88544ba948c427ceaa5fd6043e577695ec0
                                                                                                                                                  • Instruction ID: 3c7e5f1cece18e3a4ffeb2a89911fbfa3b7107d67d380c2fdf27fd84a1826db4
                                                                                                                                                  • Opcode Fuzzy Hash: 298f7b2a666c55937c0a4044f00fb88544ba948c427ceaa5fd6043e577695ec0
                                                                                                                                                  • Instruction Fuzzy Hash: FD01E121B1C75951EA44BBA29800069E691AB9AFE0F884631DE6C17BD6EF3CF0019310
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BDEB8 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • RtlAllocateHeap.NTDLL(?,?,00000000,00007FF73D7BAA16,?,?,?,00007FF73D7B9BD3,?,?,00000000,00007FF73D7B9E6E), ref: 00007FF73D7BDF0D
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: AllocateHeap
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1279760036-0
                                                                                                                                                  • Opcode ID: 69550027ed8e3bf035e7bef6798a6f7658c1153be72ca181ca789a5114add420
                                                                                                                                                  • Instruction ID: 7da089473aa26f62989ef3f5f1587ebcdddf4086610b21ed715ad7d8ba768998
                                                                                                                                                  • Opcode Fuzzy Hash: 69550027ed8e3bf035e7bef6798a6f7658c1153be72ca181ca789a5114add420
                                                                                                                                                  • Instruction Fuzzy Hash: 95F04940B0D20B65FE587BE298542B4A2945FACB40FCC4435CA1F862D2FF2CF4826230
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BCC2C Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • RtlAllocateHeap.NTDLL(?,?,?,00007FF73D7AF1E4,?,?,?,00007FF73D7B06F6,?,?,?,?,?,00007FF73D7B275D), ref: 00007FF73D7BCC6A
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: AllocateHeap
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1279760036-0
                                                                                                                                                  • Opcode ID: b827a7ab023d1767f95784f6f7fefaf86c66ee15463514ccfd07e797832e7771
                                                                                                                                                  • Instruction ID: 46d808f0efd6a0ce807184155e0fcfa0990347bdde9abd32edbc7a856490e093
                                                                                                                                                  • Opcode Fuzzy Hash: b827a7ab023d1767f95784f6f7fefaf86c66ee15463514ccfd07e797832e7771
                                                                                                                                                  • Instruction Fuzzy Hash: ADF05E50B1D24E65FE2576F1594567591809FBD7A0FC88236E92E4A2D1FF2CB440B230
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7A6310 Relevance: 1.5, APIs: 1, Instructions: 20libraryCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 00007FF73D7A6DB0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?), ref: 00007FF73D7A6DEA
                                                                                                                                                  • LoadLibraryW.KERNEL32(?,?,00000000,00007FF73D7A22DE,?,?,?,?), ref: 00007FF73D7A6333
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ByteCharLibraryLoadMultiWide
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2592636585-0
                                                                                                                                                  • Opcode ID: 4f2292e1e78b6b04c2ade65416a023b90951e6264d27b8cd69ba397aaf3470f3
                                                                                                                                                  • Instruction ID: 77913052a8c609af7fd3d22c50dd9b4758f2060ae73ae07da983ac087d472311
                                                                                                                                                  • Opcode Fuzzy Hash: 4f2292e1e78b6b04c2ade65416a023b90951e6264d27b8cd69ba397aaf3470f3
                                                                                                                                                  • Instruction Fuzzy Hash: C4E08611B1854962DE18A7A7A90546AE251EF4CBC0BC89035DE0D47755EE2CE4914B00
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Non-executed Functions

                                                                                                                                                  Function 00007FF73D7A58E0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 139COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetTempPathW.KERNEL32(?,00000000,?,00007FF73D7A58AD), ref: 00007FF73D7A597A
                                                                                                                                                  • GetCurrentProcessId.KERNEL32(?,00007FF73D7A58AD), ref: 00007FF73D7A5980
                                                                                                                                                    • Part of subcall function 00007FF73D7A5AF0: GetEnvironmentVariableW.KERNEL32(00007FF73D7A2817,?,?,?,?,?,?), ref: 00007FF73D7A5B2A
                                                                                                                                                    • Part of subcall function 00007FF73D7A5AF0: ExpandEnvironmentStringsW.KERNEL32(?,?,?,?,?,?), ref: 00007FF73D7A5B47
                                                                                                                                                    • Part of subcall function 00007FF73D7B6818: _invalid_parameter_noinfo.LIBCMT ref: 00007FF73D7B6831
                                                                                                                                                  • SetEnvironmentVariableW.KERNEL32(?,TokenIntegrityLevel), ref: 00007FF73D7A5A31
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Environment$Variable$CurrentExpandPathProcessStringsTemp_invalid_parameter_noinfo
                                                                                                                                                  • String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
                                                                                                                                                  • API String ID: 1556224225-1116378104
                                                                                                                                                  • Opcode ID: a44a740facdf1d92c96cc1d57dfc7a24484df9c802c516da767de91bd523a684
                                                                                                                                                  • Instruction ID: 78d302aa24c31cb0675fec92773ab3791572cfcb0d35809826cf7892d8883227
                                                                                                                                                  • Opcode Fuzzy Hash: a44a740facdf1d92c96cc1d57dfc7a24484df9c802c516da767de91bd523a684
                                                                                                                                                  • Instruction Fuzzy Hash: 8D516810B0D64A74EE54BBE2A9552BAD2A16F5DBD4FC44031ED0E4BB96FF2CF401A320
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF8A8093354 Relevance: 13.6, APIs: 9, Instructions: 72COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2441062409.00007FF8A8091000.00000040.00000001.01000000.0000001E.sdmp, Offset: 00007FF8A8090000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2441033358.00007FF8A8090000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441062409.00007FF8A80EC000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441062409.00007FF8A8137000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441062409.00007FF8A813B000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441062409.00007FF8A8140000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441062409.00007FF8A8195000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441062409.00007FF8A819B000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441062409.00007FF8A819E000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441362670.00007FF8A819F000.00000080.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441390190.00007FF8A81A1000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff8a8090000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: 00007ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3558122275-0
                                                                                                                                                  • Opcode ID: f3bfa0d7e3a45517c18d5de04843167fa21b807f60634c4a76319ccc9bdfb4aa
                                                                                                                                                  • Instruction ID: 584e279579235ebd57d79795e62c91fb492d50b6ecf6dd4fec74479dc2046366
                                                                                                                                                  • Opcode Fuzzy Hash: f3bfa0d7e3a45517c18d5de04843167fa21b807f60634c4a76319ccc9bdfb4aa
                                                                                                                                                  • Instruction Fuzzy Hash: 03312D7260AF8196EB609F61E8803EE7360FB84784F444439DA5E47BD4DF38D558CB24
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF8A81B4480 Relevance: 12.2, APIs: 8, Instructions: 246fileCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2441450814.00007FF8A81B1000.00000040.00000001.01000000.00000017.sdmp, Offset: 00007FF8A81B0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2441421471.00007FF8A81B0000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A81BD000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8215000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8229000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A823A000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8240000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A824D000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A83F6000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A83F8000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8423000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8454000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A847A000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A84C7000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A84CF000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A84EB000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A84F8000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2442136726.00007FF8A84FC000.00000080.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2442165063.00007FF8A84FE000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff8a81b0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ByteCharMultiWide$FileFind$00007C610ErrorF020FirstLastNext
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 448414246-0
                                                                                                                                                  • Opcode ID: bf4024f68e3e1b44317f9b66725c75e59e0182f0fb6d1c05b215eb9eb008ad04
                                                                                                                                                  • Instruction ID: 643c0cdb00611f06819775b597944f7af5906108326d8b3330faecbec2dc0140
                                                                                                                                                  • Opcode Fuzzy Hash: bf4024f68e3e1b44317f9b66725c75e59e0182f0fb6d1c05b215eb9eb008ad04
                                                                                                                                                  • Instruction Fuzzy Hash: F7B1F222A1AE829AEB148F25D85427D67A0FF45BE4F485335DB9E537D4EF3CE0418328
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7AAA2C Relevance: 10.6, APIs: 7, Instructions: 72COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3140674995-0
                                                                                                                                                  • Opcode ID: 414c3b7d1a52ef3ba5408d69683659119c26abb58edcf35ad0cee906abb0d3fb
                                                                                                                                                  • Instruction ID: e7732b1cae41157c743cfbfa39694a303825a54aaf0bdadc6f7f52e7c75e2d1c
                                                                                                                                                  • Opcode Fuzzy Hash: 414c3b7d1a52ef3ba5408d69683659119c26abb58edcf35ad0cee906abb0d3fb
                                                                                                                                                  • Instruction Fuzzy Hash: 28316572619B859AEB609FA0E8403EDB371FB48755F844039DA8D47794EF3CD548D720
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7B9C44 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1239891234-0
                                                                                                                                                  • Opcode ID: 5dfb057c3f1a11160ff10646ccc1b52b02cf652cbed9a545e94d4dbf2c44da7d
                                                                                                                                                  • Instruction ID: 8d5fe2a6a2ffee7f65fa2768026c1b19fb232a7a0287faf5c1036e09091e0012
                                                                                                                                                  • Opcode Fuzzy Hash: 5dfb057c3f1a11160ff10646ccc1b52b02cf652cbed9a545e94d4dbf2c44da7d
                                                                                                                                                  • Instruction Fuzzy Hash: FA31713261CF859AEB60DF65E8402AEB3A0FB88754F900136EA9D43B54EF3CE155CB10
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF8A81B3EBD Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 280COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2441450814.00007FF8A81B1000.00000040.00000001.01000000.00000017.sdmp, Offset: 00007FF8A81B0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2441421471.00007FF8A81B0000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A81BD000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8215000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8229000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A823A000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8240000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A824D000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A83F6000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A83F8000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8423000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8454000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A847A000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A84C7000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A84CF000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A84EB000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A84F8000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2442136726.00007FF8A84FC000.00000080.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2442165063.00007FF8A84FE000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff8a81b0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Fiber$ErrorLastSwitch$CreateValue
                                                                                                                                                  • String ID: *$..\s\crypto\async\async.c
                                                                                                                                                  • API String ID: 3645934416-1471988776
                                                                                                                                                  • Opcode ID: bd6c83728c9125bd7923cc3e504ec05b494e92e94b7f9ceb88ffe033b218295b
                                                                                                                                                  • Instruction ID: ee7be20f5ef66fdcbc422b16d8c130ae27ad2ec6f6051ebe548a1b4b3a72207c
                                                                                                                                                  • Opcode Fuzzy Hash: bd6c83728c9125bd7923cc3e504ec05b494e92e94b7f9ceb88ffe033b218295b
                                                                                                                                                  • Instruction Fuzzy Hash: 82C1AF32A0A702A6EB21DF22E4056BA73A5FF44BC0F844435CA4D47B95EF3DE555C328
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7C0A34 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: FileFindFirst_invalid_parameter_noinfo
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2227656907-0
                                                                                                                                                  • Opcode ID: 9f9ca1d73139302c1f8dadc28b774b2f708e59aaaf6a5032caa9291e182b955e
                                                                                                                                                  • Instruction ID: e422c403e1153449071b0164cf84c024ec30c100d2f5e9a2eddfc1ba84884ca9
                                                                                                                                                  • Opcode Fuzzy Hash: 9f9ca1d73139302c1f8dadc28b774b2f708e59aaaf6a5032caa9291e182b955e
                                                                                                                                                  • Instruction Fuzzy Hash: 4EB1C762B1C69A59EA61EBA198001B9E350EB58BF4FC44132E99E07BC5FF3CF451D360
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF8A80912C0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 362COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2441062409.00007FF8A8091000.00000040.00000001.01000000.0000001E.sdmp, Offset: 00007FF8A8090000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2441033358.00007FF8A8090000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441062409.00007FF8A80EC000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441062409.00007FF8A8137000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441062409.00007FF8A813B000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441062409.00007FF8A8140000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441062409.00007FF8A8195000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441062409.00007FF8A819B000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441062409.00007FF8A819E000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441362670.00007FF8A819F000.00000080.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441390190.00007FF8A81A1000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff8a8090000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: 00007A696
                                                                                                                                                  • String ID: 0
                                                                                                                                                  • API String ID: 815660849-4108050209
                                                                                                                                                  • Opcode ID: 9c617f3b2e959f12495cdfb33a5913068961d149ce39f7153d8c80afd332587c
                                                                                                                                                  • Instruction ID: 974c8a1ac72373644885bcb3f8fc61b3dd140bea65b80d2baee0ad67a3734834
                                                                                                                                                  • Opcode Fuzzy Hash: 9c617f3b2e959f12495cdfb33a5913068961d149ce39f7153d8c80afd332587c
                                                                                                                                                  • Instruction Fuzzy Hash: C9F1D032B0ED52A5EF748B25D45867932A5FB657C0F055131EA8E827D0EF3CE861CB24
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7A2F20 Relevance: 291.0, APIs: 55, Strings: 111, Instructions: 457libraryloaderCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,00000000,00007FF73D7A22DE,?,?,?,?), ref: 00007FF73D7A2F36
                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,00000000,00007FF73D7A22DE,?,?,?,?), ref: 00007FF73D7A2F75
                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,00000000,00007FF73D7A22DE,?,?,?,?), ref: 00007FF73D7A2F9A
                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,00000000,00007FF73D7A22DE,?,?,?,?), ref: 00007FF73D7A2FBF
                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,00000000,00007FF73D7A22DE,?,?,?,?), ref: 00007FF73D7A2FE7
                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,00000000,00007FF73D7A22DE,?,?,?,?), ref: 00007FF73D7A300F
                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,00000000,00007FF73D7A22DE,?,?,?,?), ref: 00007FF73D7A3037
                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,00000000,00007FF73D7A22DE,?,?,?,?), ref: 00007FF73D7A305F
                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,00000000,00007FF73D7A22DE,?,?,?,?), ref: 00007FF73D7A3087
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: AddressProc
                                                                                                                                                  • String ID: Failed to get address for PyDict_GetItemString$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyList_New$Failed to get address for PyLong_AsLong$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PySys_AddWarnOption$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetArgvEx$Failed to get address for PySys_SetObject$Failed to get address for PySys_SetPath$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_BuildValue$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_DontWriteBytecodeFlag$Failed to get address for Py_FileSystemDefaultEncoding$Failed to get address for Py_Finalize$Failed to get address for Py_FrozenFlag$Failed to get address for Py_GetPath$Failed to get address for Py_IgnoreEnvironmentFlag$Failed to get address for Py_IncRef$Failed to get address for Py_Initialize$Failed to get address for Py_NoSiteFlag$Failed to get address for Py_NoUserSiteDirectory$Failed to get address for Py_OptimizeFlag$Failed to get address for Py_SetPath$Failed to get address for Py_SetProgramName$Failed to get address for Py_SetPythonHome$Failed to get address for Py_UTF8Mode$Failed to get address for Py_UnbufferedStdioFlag$Failed to get address for Py_VerboseFlag$GetProcAddress$PyDict_GetItemString$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyList_New$PyLong_AsLong$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyRun_SimpleStringFlags$PySys_AddWarnOption$PySys_GetObject$PySys_SetArgvEx$PySys_SetObject$PySys_SetPath$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_BuildValue$Py_DecRef$Py_DecodeLocale$Py_DontWriteBytecodeFlag$Py_FileSystemDefaultEncoding$Py_Finalize$Py_FrozenFlag$Py_GetPath$Py_IgnoreEnvironmentFlag$Py_IncRef$Py_Initialize$Py_NoSiteFlag$Py_NoUserSiteDirectory$Py_OptimizeFlag$Py_SetPath$Py_SetProgramName$Py_SetPythonHome$Py_UTF8Mode$Py_UnbufferedStdioFlag$Py_VerboseFlag
                                                                                                                                                  • API String ID: 190572456-3109299426
                                                                                                                                                  • Opcode ID: 3d8788b48c699204fb620db4b6681a167f3e5177f9efbc96361098fa63709e71
                                                                                                                                                  • Instruction ID: 90c808ff90b4c3480468f1f815a2a847eb6a26a471bad97f6f0923529f9b8812
                                                                                                                                                  • Opcode Fuzzy Hash: 3d8788b48c699204fb620db4b6681a167f3e5177f9efbc96361098fa63709e71
                                                                                                                                                  • Instruction Fuzzy Hash: D5428465E4DB0BF5EA15BB84A858174A3A1BF0C7A1BD46035D88E06364FF7CF558B320
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7A4730 Relevance: 166.5, APIs: 31, Strings: 64, Instructions: 287libraryloaderCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: AddressProc$LibraryLoad
                                                                                                                                                  • String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$LOADER: Failed to load tcl/tk libraries$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                                                                                                  • API String ID: 2238633743-1453502826
                                                                                                                                                  • Opcode ID: e0502fcf1b420640f725b5f986344d9b1d5f93aef03ede1fdd1d364c869fabcf
                                                                                                                                                  • Instruction ID: 8f2293016b732da2165b862d60a6b8d4acf9c2fbfcbe97595a3fbeb737544673
                                                                                                                                                  • Opcode Fuzzy Hash: e0502fcf1b420640f725b5f986344d9b1d5f93aef03ede1fdd1d364c869fabcf
                                                                                                                                                  • Instruction Fuzzy Hash: 6EE1A364A0DB0BB4FA15BB94A854174A3A5BF0CBA1BD45035D88E06368FF7CF588B360
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF8A8360A80 Relevance: 58.0, APIs: 19, Strings: 14, Instructions: 220COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • 00007FF8C6125630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A83616E9,?,?,?,?,?,?,?,?,00007FF8A835F6EB), ref: 00007FF8A8360AD1
                                                                                                                                                  • 00007FF8C6125630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A83616E9,?,?,?,?,?,?,?,?,00007FF8A835F6EB), ref: 00007FF8A8360AE8
                                                                                                                                                  • 00007FF8C6125630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A83616E9,?,?,?,?,?,?,?,?,00007FF8A835F6EB), ref: 00007FF8A8360AFF
                                                                                                                                                  • 00007FF8C6125630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A83616E9,?,?,?,?,?,?,?,?,00007FF8A835F6EB), ref: 00007FF8A8360B33
                                                                                                                                                  • 00007FF8C6125630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A83616E9,?,?,?,?,?,?,?,?,00007FF8A835F6EB), ref: 00007FF8A8360B9F
                                                                                                                                                  • 00007FF8C6125630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A83616E9,?,?,?,?,?,?,?,?,00007FF8A835F6EB), ref: 00007FF8A8360BD6
                                                                                                                                                  • 00007FF8C6125630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A83616E9,?,?,?,?,?,?,?,?,00007FF8A835F6EB), ref: 00007FF8A8360C37
                                                                                                                                                  • 00007FF8C6125630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A83616E9,?,?,?,?,?,?,?,?,00007FF8A835F6EB), ref: 00007FF8A8360C4A
                                                                                                                                                  • 00007FF8C6125630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A83616E9,?,?,?,?,?,?,?,?,00007FF8A835F6EB), ref: 00007FF8A8360C61
                                                                                                                                                  • 00007FF8C6125630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A83616E9,?,?,?,?,?,?,?,?,00007FF8A835F6EB), ref: 00007FF8A8360C74
                                                                                                                                                  • 00007FF8C6125630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A83616E9,?,?,?,?,?,?,?,?,00007FF8A835F6EB), ref: 00007FF8A8360C8B
                                                                                                                                                  • 00007FF8C6125630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A83616E9,?,?,?,?,?,?,?,?,00007FF8A835F6EB), ref: 00007FF8A8360C9E
                                                                                                                                                  • 00007FF8C6125630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A83616E9,?,?,?,?,?,?,?,?,00007FF8A835F6EB), ref: 00007FF8A8360CB5
                                                                                                                                                  • 00007FF8C6125630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A83616E9,?,?,?,?,?,?,?,?,00007FF8A835F6EB), ref: 00007FF8A8360CC8
                                                                                                                                                  • 00007FF8C6125630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A83616E9,?,?,?,?,?,?,?,?,00007FF8A835F6EB), ref: 00007FF8A8360CDF
                                                                                                                                                  • 00007FF8C6125630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A83616E9,?,?,?,?,?,?,?,?,00007FF8A835F6EB), ref: 00007FF8A8360CF2
                                                                                                                                                  • 00007FF8C6125630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A83616E9,?,?,?,?,?,?,?,?,00007FF8A835F6EB), ref: 00007FF8A8360D09
                                                                                                                                                  • 00007FF8C6125630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A83616E9,?,?,?,?,?,?,?,?,00007FF8A835F6EB), ref: 00007FF8A8360D42
                                                                                                                                                  • 00007FF8C6125630.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00007FF8A83616E9,?,?,?,?,?,?,?,?,00007FF8A835F6EB), ref: 00007FF8A8360D72
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2441450814.00007FF8A824D000.00000040.00000001.01000000.00000017.sdmp, Offset: 00007FF8A81B0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2441421471.00007FF8A81B0000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A81B1000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A81BD000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8215000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8229000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A823A000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8240000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A83F6000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A83F8000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8423000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8454000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A847A000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A84C7000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A84CF000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A84EB000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A84F8000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2442136726.00007FF8A84FC000.00000080.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2442165063.00007FF8A84FE000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff8a81b0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: 00007C6125630
                                                                                                                                                  • String ID: ANY PRIVATE KEY$CERTIFICATE$CERTIFICATE REQUEST$CMS$DH PARAMETERS$ENCRYPTED PRIVATE KEY$NEW CERTIFICATE REQUEST$PARAMETERS$PKCS #7 SIGNED DATA$PKCS7$PRIVATE KEY$TRUSTED CERTIFICATE$X509 CERTIFICATE$X9.42 DH PARAMETERS
                                                                                                                                                  • API String ID: 1529501491-1119032718
                                                                                                                                                  • Opcode ID: af3d817a0d09ecacb928f5750cd0fa4b550fcc35063cd53c557b409c5034f3df
                                                                                                                                                  • Instruction ID: a82b1981b1945d4d6834280b4ebfad6bc00f225ad01628858ff088080c9a0b84
                                                                                                                                                  • Opcode Fuzzy Hash: af3d817a0d09ecacb928f5750cd0fa4b550fcc35063cd53c557b409c5034f3df
                                                                                                                                                  • Instruction Fuzzy Hash: 7F91E311E0FE47B1FE945B2995A12BAA690DF01BD4F8C42B1C94EA22D5FF9CF4018739
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7A6BF0 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 113COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • MultiByteToWideChar.KERNEL32 ref: 00007FF73D7A6C2C
                                                                                                                                                    • Part of subcall function 00007FF73D7A1CB0: GetLastError.KERNEL32(?,?,00000000,00007FF73D7A6904,?,?,?,?,?,?,?,?,?,?,?,00007FF73D7A1023), ref: 00007FF73D7A1CD7
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ByteCharErrorLastMultiWide
                                                                                                                                                  • String ID: Failed to decode wchar_t from UTF-8$Failed to encode filename as ANSI.$Failed to get ANSI buffer size.$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$WideCharToMultiByte$win32_utils_from_utf8$win32_wcs_to_mbs
                                                                                                                                                  • API String ID: 203985260-1562484376
                                                                                                                                                  • Opcode ID: 4738581143a7505b28abcd57c7c993806daa07168fe16da415c29e9b13c2df9d
                                                                                                                                                  • Instruction ID: ce4bbda8309154f9ac2cfb1749fd0945ef60caa6e6a92a622fe2b4ec31b290bc
                                                                                                                                                  • Opcode Fuzzy Hash: 4738581143a7505b28abcd57c7c993806daa07168fe16da415c29e9b13c2df9d
                                                                                                                                                  • Instruction Fuzzy Hash: 64417661A0CA4A65EA20FBA1A84007AE6A1AF5CBD4FD44135E94D47B95FF3CF145A320
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7A1440 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 133COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID: Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc
                                                                                                                                                  • API String ID: 0-666925554
                                                                                                                                                  • Opcode ID: 7dbbe491418536e41ef5334edc3cc0a1006c93e87b10a1556a8050f18f187757
                                                                                                                                                  • Instruction ID: 481a343d180af8dca95f6785f88a6ef222e1ecc457756f566588caaab900ea68
                                                                                                                                                  • Opcode Fuzzy Hash: 7dbbe491418536e41ef5334edc3cc0a1006c93e87b10a1556a8050f18f187757
                                                                                                                                                  • Instruction Fuzzy Hash: 98519B21B0C64AA5FA10BBA1A4146B9E3A0BF49BE8FC54431DE5D47795FF3CF149A320
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF8A81B33A0 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 127COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2441450814.00007FF8A81B1000.00000040.00000001.01000000.00000017.sdmp, Offset: 00007FF8A81B0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2441421471.00007FF8A81B0000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A81BD000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8215000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8229000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A823A000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8240000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A824D000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A83F6000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A83F8000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8423000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8454000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A847A000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A84C7000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A84CF000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A84EB000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A84F8000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2442136726.00007FF8A84FC000.00000080.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2442165063.00007FF8A84FE000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff8a81b0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: 00007$C6111370$C6125630
                                                                                                                                                  • String ID: ..\s\crypto\ts\ts_conf.c$accuracy$microsecs$millisecs$p$secs$^;#
                                                                                                                                                  • API String ID: 4071599892-2905893130
                                                                                                                                                  • Opcode ID: 50a372e4d8d9be1f7db291ab6937b65d881ce4e2a7fc06064df732d34306b3e9
                                                                                                                                                  • Instruction ID: e9302708e7c6151efa53aff533f45a4da055e5438f9ca2b312c5e7e435f950da
                                                                                                                                                  • Opcode Fuzzy Hash: 50a372e4d8d9be1f7db291ab6937b65d881ce4e2a7fc06064df732d34306b3e9
                                                                                                                                                  • Instruction Fuzzy Hash: 2651C061A1BA07A6EB06AB22EC145B9B394FF44BC4F484435DE0E037A5EF3DE545C328
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7A6A60 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 91COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Token$ConvertDescriptorInformationProcessSecurityString$CloseCreateCurrentDirectoryErrorFreeHandleLastLocalOpen
                                                                                                                                                  • String ID: D:(A;;FA;;;%s)$S-1-3-4
                                                                                                                                                  • API String ID: 4998090-2855260032
                                                                                                                                                  • Opcode ID: e3ae2089cc123d46b594be8ff950cb64da25cc15db14cd9a57b660644dd56c7b
                                                                                                                                                  • Instruction ID: 47a29afdb2c347df1fd09069e77d1222c6ec10a8bc20925fa0887846edc1a1fa
                                                                                                                                                  • Opcode Fuzzy Hash: e3ae2089cc123d46b594be8ff950cb64da25cc15db14cd9a57b660644dd56c7b
                                                                                                                                                  • Instruction Fuzzy Hash: 8C41863161CA8A95E750AF90E4446AAB361FB887A4FD00231E99E47BD4FF3CF449D720
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF8A8092654 Relevance: 16.7, APIs: 11, Instructions: 230COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2441062409.00007FF8A8091000.00000040.00000001.01000000.0000001E.sdmp, Offset: 00007FF8A8090000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2441033358.00007FF8A8090000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441062409.00007FF8A80EC000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441062409.00007FF8A8137000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441062409.00007FF8A813B000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441062409.00007FF8A8140000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441062409.00007FF8A8195000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441062409.00007FF8A819B000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441062409.00007FF8A819E000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441362670.00007FF8A819F000.00000080.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441390190.00007FF8A81A1000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff8a8090000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_crt__scrt_release_startup_lock
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 349153199-0
                                                                                                                                                  • Opcode ID: 24b64e2f523494cfc43b7842a0679e99e8ee080510d7dd6f5954d2b0f176455c
                                                                                                                                                  • Instruction ID: fe8ac39b854e6f8d2582fa2226d20d6f41546f54fa2009a8b078f525f2f43bf8
                                                                                                                                                  • Opcode Fuzzy Hash: 24b64e2f523494cfc43b7842a0679e99e8ee080510d7dd6f5954d2b0f176455c
                                                                                                                                                  • Instruction Fuzzy Hash: B181C121F0FE43AAFE50AB6694412797291EF857C0F058035EA6C537E6DF3CE8658728
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7A6670 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetLastError.KERNEL32(WideCharToMultiByte,00007FF73D7A1CE4,?,?,00000000,00007FF73D7A6904), ref: 00007FF73D7A6697
                                                                                                                                                  • FormatMessageW.KERNEL32 ref: 00007FF73D7A66C6
                                                                                                                                                  • WideCharToMultiByte.KERNEL32 ref: 00007FF73D7A671C
                                                                                                                                                    • Part of subcall function 00007FF73D7A1CB0: GetLastError.KERNEL32(?,?,00000000,00007FF73D7A6904,?,?,?,?,?,?,?,?,?,?,?,00007FF73D7A1023), ref: 00007FF73D7A1CD7
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ErrorLast$ByteCharFormatMessageMultiWide
                                                                                                                                                  • String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
                                                                                                                                                  • API String ID: 2383786077-2573406579
                                                                                                                                                  • Opcode ID: ee4750cad08e904e569e44cd6da303e01fcfffc44399732fd87d74f29f2688a4
                                                                                                                                                  • Instruction ID: 815852d30fee7c1ce0e64ec1f14ac4bb5f39a45abcdd9b419e6c79d16d07df21
                                                                                                                                                  • Opcode Fuzzy Hash: ee4750cad08e904e569e44cd6da303e01fcfffc44399732fd87d74f29f2688a4
                                                                                                                                                  • Instruction Fuzzy Hash: 3C21AF31A1CA4AA5F760AB91E854269A365FB8C794FC40035E68D837A4FF3CF149A720
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7AF5C8 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                  • String ID: f$f$p$p$f
                                                                                                                                                  • API String ID: 3215553584-1325933183
                                                                                                                                                  • Opcode ID: 5b8d5396a44c552a0cc4e48ad8092be8cf806d396b8c8f6251230df5f0eb9214
                                                                                                                                                  • Instruction ID: 01c71594f1727119d9f81ba734688642d85b0da97f00d24c037ed876a9967557
                                                                                                                                                  • Opcode Fuzzy Hash: 5b8d5396a44c552a0cc4e48ad8092be8cf806d396b8c8f6251230df5f0eb9214
                                                                                                                                                  • Instruction Fuzzy Hash: 4E12A622E0C14BA5FB60BA95D0546BAF261FF88754FD44032F699467C4EF3CF482AB21
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF8A81B1073 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 94libraryloaderCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2441450814.00007FF8A81B1000.00000040.00000001.01000000.00000017.sdmp, Offset: 00007FF8A81B0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2441421471.00007FF8A81B0000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A81BD000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8215000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8229000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A823A000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8240000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A824D000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A83F6000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A83F8000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8423000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8454000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A847A000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A84C7000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A84CF000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A84EB000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A84F8000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2442136726.00007FF8A84FC000.00000080.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2442165063.00007FF8A84FE000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff8a81b0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: InformationObjectUser$AddressErrorHandleLastModuleProcProcessStationWindow
                                                                                                                                                  • String ID: Service-0x$_OPENSSL_isservice
                                                                                                                                                  • API String ID: 1944374717-1672312481
                                                                                                                                                  • Opcode ID: 27800432323ea3a30382ce8154a855d4d03fb00c45efe0a7b9c8eb2db422071d
                                                                                                                                                  • Instruction ID: d2834df0602cfc1793f9dbe6b2bab4888a6c026c71600d749e6f3911a948b1d2
                                                                                                                                                  • Opcode Fuzzy Hash: 27800432323ea3a30382ce8154a855d4d03fb00c45efe0a7b9c8eb2db422071d
                                                                                                                                                  • Instruction Fuzzy Hash: 4541812160BB82AAEB509F24D8442B82790FF447F4F484735EA7D4B7D9EF2CE1458328
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7A6130 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90processsynchronizationCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
                                                                                                                                                  • String ID: CreateProcessW$Error creating child process!
                                                                                                                                                  • API String ID: 2895956056-3524285272
                                                                                                                                                  • Opcode ID: d5693698e4819ce5d510509d5cda6c943b390b1bcdb6e918232fd1435297541c
                                                                                                                                                  • Instruction ID: 6b402114e684e3abb3628e1f36c36bd00d3bae0638bbf482adeb6fe004d4acb9
                                                                                                                                                  • Opcode Fuzzy Hash: d5693698e4819ce5d510509d5cda6c943b390b1bcdb6e918232fd1435297541c
                                                                                                                                                  • Instruction Fuzzy Hash: BE411531A0CB8695DA20ABA0F4552AAF360FB98364F900335E6AD43BD5EF7CE0449B10
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7ACF90 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                                                                                                  • String ID: csm$csm$csm
                                                                                                                                                  • API String ID: 849930591-393685449
                                                                                                                                                  • Opcode ID: c9717f7599358984fa081211ebe6d8e8a7f2fe77f13a54a703b9fcdffbee59eb
                                                                                                                                                  • Instruction ID: e2d5e961043de3c1a812f6620843a655433bc26196b0d968643a396a0d47f3aa
                                                                                                                                                  • Opcode Fuzzy Hash: c9717f7599358984fa081211ebe6d8e8a7f2fe77f13a54a703b9fcdffbee59eb
                                                                                                                                                  • Instruction Fuzzy Hash: 6BE18272A0C749A6EB20ABA5D4403ADB7A0FB48798F904135EE8D57B95FF38F481D710
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BDF30 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • FreeLibrary.KERNEL32(?,00000000,?,00007FF73D7BE2CA,?,?,-00000018,00007FF73D7BA383,?,?,?,00007FF73D7BA27A,?,?,?,00007FF73D7B54E2), ref: 00007FF73D7BE0AC
                                                                                                                                                  • GetProcAddress.KERNEL32(?,00000000,?,00007FF73D7BE2CA,?,?,-00000018,00007FF73D7BA383,?,?,?,00007FF73D7BA27A,?,?,?,00007FF73D7B54E2), ref: 00007FF73D7BE0B8
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: AddressFreeLibraryProc
                                                                                                                                                  • String ID: api-ms-$ext-ms-
                                                                                                                                                  • API String ID: 3013587201-537541572
                                                                                                                                                  • Opcode ID: 5d4014bca18f9f9ee9ee76f308e7221266f6712ab36b1d3e30b229e2872ef72f
                                                                                                                                                  • Instruction ID: a5d48aec32c7ec175a213d8bb1b94824a3f665acc227341ffb1a2daacbed434a
                                                                                                                                                  • Opcode Fuzzy Hash: 5d4014bca18f9f9ee9ee76f308e7221266f6712ab36b1d3e30b229e2872ef72f
                                                                                                                                                  • Instruction Fuzzy Hash: 58415622B2DA1AA5FA19EB969800675A391BF1CBE0FD84135DD5D87384FF3CF445A320
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7A67C0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 103COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF73D7A1023), ref: 00007FF73D7A685F
                                                                                                                                                  • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF73D7A1023), ref: 00007FF73D7A68AF
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ByteCharMultiWide
                                                                                                                                                  • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                                                                                                                                  • API String ID: 626452242-27947307
                                                                                                                                                  • Opcode ID: 6005c3c3b021663ea81aa36166b0848140842be883a1b4f62739566592ce7020
                                                                                                                                                  • Instruction ID: 4339a73eb9ec222c11867c4f7d6b40c6e65aab0f9a0fc61970465268fcf742ed
                                                                                                                                                  • Opcode Fuzzy Hash: 6005c3c3b021663ea81aa36166b0848140842be883a1b4f62739566592ce7020
                                                                                                                                                  • Instruction Fuzzy Hash: C541C532A0CF8695E620EF91B840169F7A4FB98B94F944135DA8D47B94FF3CE055D710
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7A6EC0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • WideCharToMultiByte.KERNEL32(00000000,00007FF73D7A2D35,?,?,?,?,?,?), ref: 00007FF73D7A6F01
                                                                                                                                                    • Part of subcall function 00007FF73D7A1CB0: GetLastError.KERNEL32(?,?,00000000,00007FF73D7A6904,?,?,?,?,?,?,?,?,?,?,?,00007FF73D7A1023), ref: 00007FF73D7A1CD7
                                                                                                                                                  • WideCharToMultiByte.KERNEL32(00000000,00007FF73D7A2D35,?,?,?,?,?,?), ref: 00007FF73D7A6F75
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ByteCharMultiWide$ErrorLast
                                                                                                                                                  • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                                                                                                                                  • API String ID: 1717984340-27947307
                                                                                                                                                  • Opcode ID: d869b65ad41923ea885775a182ffbbb4fa8a6a55f9429b012359a23964d7bd56
                                                                                                                                                  • Instruction ID: a9b3a82bb95362137b407c2e31af28b0b28ddb2d6347e2ea6eec56dc38ca71eb
                                                                                                                                                  • Opcode Fuzzy Hash: d869b65ad41923ea885775a182ffbbb4fa8a6a55f9429b012359a23964d7bd56
                                                                                                                                                  • Instruction Fuzzy Hash: 7E215E61A0CB4AA9E720EB96A840069F761BB88B90B944135EA4D437A4FF3CF555A310
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7B93C4 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                  • String ID: f$p$p
                                                                                                                                                  • API String ID: 3215553584-1995029353
                                                                                                                                                  • Opcode ID: d478605e8072a694eb9a9d804e4987f1596106984b5661be3eee2fb972e34d58
                                                                                                                                                  • Instruction ID: da0d617228a30c9d7032741e0ac2749ba30ec24b02b45cb7c6d6aeb406e88bc1
                                                                                                                                                  • Opcode Fuzzy Hash: d478605e8072a694eb9a9d804e4987f1596106984b5661be3eee2fb972e34d58
                                                                                                                                                  • Instruction Fuzzy Hash: 2212D4A2E0C14BA6FB607A95D0542BAF691FBA8750FD44035D6A9476C4FF3CF580EB20
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7A6FB0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 98COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ByteCharMultiWide
                                                                                                                                                  • String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                                                                                                                                  • API String ID: 626452242-876015163
                                                                                                                                                  • Opcode ID: 15182e71835fbe62ed04ed96ffee69818c29c72be0e860e28e8d56ff05f5ea04
                                                                                                                                                  • Instruction ID: f1047944836d24e909ff2e6c70373b4811ace27e629284149685260dcc4371d1
                                                                                                                                                  • Opcode Fuzzy Hash: 15182e71835fbe62ed04ed96ffee69818c29c72be0e860e28e8d56ff05f5ea04
                                                                                                                                                  • Instruction Fuzzy Hash: B841D332A0CB5AA5E610EF55A84017AB6A5FB88B94FD40135EE8D47BA4FF3CF052D710
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7A55E0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 00007FF73D7A6DB0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,?), ref: 00007FF73D7A6DEA
                                                                                                                                                  • ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF73D7A592F,?,00000000,?,TokenIntegrityLevel), ref: 00007FF73D7A563F
                                                                                                                                                  Strings
                                                                                                                                                  • LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF73D7A5653
                                                                                                                                                  • LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF73D7A5616
                                                                                                                                                  • LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF73D7A569A
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ByteCharEnvironmentExpandMultiStringsWide
                                                                                                                                                  • String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
                                                                                                                                                  • API String ID: 2001182103-3498232454
                                                                                                                                                  • Opcode ID: 1f426a93b6cac929cbf670ac030889d357a0e2c62746adcecc4bd95078451b9f
                                                                                                                                                  • Instruction ID: 86a1dfbd161f058e244d01c0e900eeeead38b42a3519b2b64ba5da4a0335936d
                                                                                                                                                  • Opcode Fuzzy Hash: 1f426a93b6cac929cbf670ac030889d357a0e2c62746adcecc4bd95078451b9f
                                                                                                                                                  • Instruction Fuzzy Hash: 7431A551B1C78AB0FA64B7A1D9152BAE2A1AF9C7D0FC44431DA4E43786FF2CF1049720
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7AC248 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • LoadLibraryExW.KERNEL32(?,?,?,00007FF73D7AC4FA,?,?,?,00007FF73D7AC1EC,?,?,00000001,00007FF73D7ABE09), ref: 00007FF73D7AC2CD
                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,00007FF73D7AC4FA,?,?,?,00007FF73D7AC1EC,?,?,00000001,00007FF73D7ABE09), ref: 00007FF73D7AC2DB
                                                                                                                                                  • LoadLibraryExW.KERNEL32(?,?,?,00007FF73D7AC4FA,?,?,?,00007FF73D7AC1EC,?,?,00000001,00007FF73D7ABE09), ref: 00007FF73D7AC305
                                                                                                                                                  • FreeLibrary.KERNEL32(?,?,?,00007FF73D7AC4FA,?,?,?,00007FF73D7AC1EC,?,?,00000001,00007FF73D7ABE09), ref: 00007FF73D7AC34B
                                                                                                                                                  • GetProcAddress.KERNEL32(?,?,?,00007FF73D7AC4FA,?,?,?,00007FF73D7AC1EC,?,?,00000001,00007FF73D7ABE09), ref: 00007FF73D7AC357
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                                                  • String ID: api-ms-
                                                                                                                                                  • API String ID: 2559590344-2084034818
                                                                                                                                                  • Opcode ID: 9ce77a0163c425c367fd7c26c9c82fe5a817cd2dfec158d19dd861a4531b58f3
                                                                                                                                                  • Instruction ID: 694132b2ef6b5575094d74aa604baf6f8deadee6b696ef2ffab5625fe4e60659
                                                                                                                                                  • Opcode Fuzzy Hash: 9ce77a0163c425c367fd7c26c9c82fe5a817cd2dfec158d19dd861a4531b58f3
                                                                                                                                                  • Instruction Fuzzy Hash: D231B225A0E64AB5EE51AB8AA800579A394FF0DBA0FD90535EE1D47384FF3CF0449721
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7A6DB0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • MultiByteToWideChar.KERNEL32(?,?,?,?,?,?), ref: 00007FF73D7A6DEA
                                                                                                                                                    • Part of subcall function 00007FF73D7A1CB0: GetLastError.KERNEL32(?,?,00000000,00007FF73D7A6904,?,?,?,?,?,?,?,?,?,?,?,00007FF73D7A1023), ref: 00007FF73D7A1CD7
                                                                                                                                                  • MultiByteToWideChar.KERNEL32(?,?,?,?,?,?), ref: 00007FF73D7A6E70
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ByteCharMultiWide$ErrorLast
                                                                                                                                                  • String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                                                                                                                                  • API String ID: 1717984340-876015163
                                                                                                                                                  • Opcode ID: 7f54e5da8ee4cb54e1cd0e604769d215f15cea2374718bc11fd99751b49c0007
                                                                                                                                                  • Instruction ID: ee1cb64ad129ad52a4548dd5ef0f8c2aaf98b9f327f118b63453657b6b6e1ab7
                                                                                                                                                  • Opcode Fuzzy Hash: 7f54e5da8ee4cb54e1cd0e604769d215f15cea2374718bc11fd99751b49c0007
                                                                                                                                                  • Instruction Fuzzy Hash: 66218521B0CA4661EB10EB69F800169E761FB8DBD4F984135DB4C83B69FF2CF5919710
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BA780 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,00007FF73D7C24B3,?,?,?,00007FF73D7BCCEC,?,?,00000000,00007FF73D7B386F,?,?,?,00007FF73D7B9473), ref: 00007FF73D7BA78F
                                                                                                                                                  • FlsGetValue.KERNEL32(?,?,?,00007FF73D7C24B3,?,?,?,00007FF73D7BCCEC,?,?,00000000,00007FF73D7B386F,?,?,?,00007FF73D7B9473), ref: 00007FF73D7BA7A4
                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF73D7C24B3,?,?,?,00007FF73D7BCCEC,?,?,00000000,00007FF73D7B386F,?,?,?,00007FF73D7B9473), ref: 00007FF73D7BA7C5
                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF73D7C24B3,?,?,?,00007FF73D7BCCEC,?,?,00000000,00007FF73D7B386F,?,?,?,00007FF73D7B9473), ref: 00007FF73D7BA7F2
                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF73D7C24B3,?,?,?,00007FF73D7BCCEC,?,?,00000000,00007FF73D7B386F,?,?,?,00007FF73D7B9473), ref: 00007FF73D7BA803
                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF73D7C24B3,?,?,?,00007FF73D7BCCEC,?,?,00000000,00007FF73D7B386F,?,?,?,00007FF73D7B9473), ref: 00007FF73D7BA814
                                                                                                                                                  • SetLastError.KERNEL32(?,?,?,00007FF73D7C24B3,?,?,?,00007FF73D7BCCEC,?,?,00000000,00007FF73D7B386F,?,?,?,00007FF73D7B9473), ref: 00007FF73D7BA82F
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Value$ErrorLast
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2506987500-0
                                                                                                                                                  • Opcode ID: 78cf2455f8789f49a255dc6ffb64301edc27073bb37ec47cc96fd54928eaf598
                                                                                                                                                  • Instruction ID: e65f284636d0e9b19f52ab4430d53f97887b3b3550bdb82e708ecf4ffafae41c
                                                                                                                                                  • Opcode Fuzzy Hash: 78cf2455f8789f49a255dc6ffb64301edc27073bb37ec47cc96fd54928eaf598
                                                                                                                                                  • Instruction Fuzzy Hash: 8C21FD20F0CA0A62FA6973E05955179EA52AF6C7B0FC40734E83E47BC6FF6CB4416220
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7C70EC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                                                  • String ID: CONOUT$
                                                                                                                                                  • API String ID: 3230265001-3130406586
                                                                                                                                                  • Opcode ID: 900c1da012dee1dfb60ea43974335527b3f6c3b56b4e810762f126343bdfd55c
                                                                                                                                                  • Instruction ID: 657aa8749b6e139b72acfed6228271fdb15503b1051557c232251e8b84308eda
                                                                                                                                                  • Opcode Fuzzy Hash: 900c1da012dee1dfb60ea43974335527b3f6c3b56b4e810762f126343bdfd55c
                                                                                                                                                  • Instruction Fuzzy Hash: B8119322B1CB459AE350AB92E854329A2A0FB8CBF5F840234DA9D87794EF7CE4449750
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BA8F8 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,00007FF73D7B6091,?,?,?,?,00007FF73D7BDF1F,?,?,00000000,00007FF73D7BAA16,?,?,?), ref: 00007FF73D7BA907
                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF73D7B6091,?,?,?,?,00007FF73D7BDF1F,?,?,00000000,00007FF73D7BAA16,?,?,?), ref: 00007FF73D7BA93D
                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF73D7B6091,?,?,?,?,00007FF73D7BDF1F,?,?,00000000,00007FF73D7BAA16,?,?,?), ref: 00007FF73D7BA96A
                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF73D7B6091,?,?,?,?,00007FF73D7BDF1F,?,?,00000000,00007FF73D7BAA16,?,?,?), ref: 00007FF73D7BA97B
                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF73D7B6091,?,?,?,?,00007FF73D7BDF1F,?,?,00000000,00007FF73D7BAA16,?,?,?), ref: 00007FF73D7BA98C
                                                                                                                                                  • SetLastError.KERNEL32(?,?,?,00007FF73D7B6091,?,?,?,?,00007FF73D7BDF1F,?,?,00000000,00007FF73D7BAA16,?,?,?), ref: 00007FF73D7BA9A7
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Value$ErrorLast
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2506987500-0
                                                                                                                                                  • Opcode ID: 62dca5d10fd8524d44a9ca6b61b614a098d57abd4030ec328ef3c17f7e173edc
                                                                                                                                                  • Instruction ID: 576ff46cf3acc65a09dc9227a87b1c183b6a49bed6d44eda76a4e226ce5dc60e
                                                                                                                                                  • Opcode Fuzzy Hash: 62dca5d10fd8524d44a9ca6b61b614a098d57abd4030ec328ef3c17f7e173edc
                                                                                                                                                  • Instruction Fuzzy Hash: 5E11DE20B0C60A62FA5873E19995179E692AFAD7B0FC54734E87E437D6FF6CB4407220
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7ABC08 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                                                                                                  • String ID: csm$f
                                                                                                                                                  • API String ID: 2395640692-629598281
                                                                                                                                                  • Opcode ID: e4cc0f9b1589dd73a5d4f416534ce71b9b3e94dd2aede877d85d93aa73312820
                                                                                                                                                  • Instruction ID: 02df527b9b837b6ca96c77ce98d63b28de1ec998c874bf49164b388b2ba260a3
                                                                                                                                                  • Opcode Fuzzy Hash: e4cc0f9b1589dd73a5d4f416534ce71b9b3e94dd2aede877d85d93aa73312820
                                                                                                                                                  • Instruction Fuzzy Hash: 4E51C732A2D60AAAD715EF55E408A39B795FB48B88FD18134EA4E47748FF38F841D710
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7B8A40 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                  • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                  • API String ID: 4061214504-1276376045
                                                                                                                                                  • Opcode ID: 78a1a69aac29132cf000f84d0d5f993c26bceca4d1e4e1c3cfa2e89eec15c9a9
                                                                                                                                                  • Instruction ID: 3f764ba9dbf79d3a14a3b9682b419b2fc83fc32fcfa706dcc57adfeff000a78d
                                                                                                                                                  • Opcode Fuzzy Hash: 78a1a69aac29132cf000f84d0d5f993c26bceca4d1e4e1c3cfa2e89eec15c9a9
                                                                                                                                                  • Instruction Fuzzy Hash: C5F04461A0D70A51EA10AB94E8543399360BF4D7B1FD40635CAAD461E4FF2CE088E320
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7C8824 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _set_statfp
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1156100317-0
                                                                                                                                                  • Opcode ID: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
                                                                                                                                                  • Instruction ID: 8a387cb5287f0b2c8d14b08fd502ee7c0803bbeec9480428bbb9fea52dd92f38
                                                                                                                                                  • Opcode Fuzzy Hash: 69d38c35bd33e64192705e47d806ebaffe6519085bb8d16871af39b095092657
                                                                                                                                                  • Instruction Fuzzy Hash: DE118622D2CA2B29F6743194D45537591816F5D374F890634E9EE4BADBEF2CB8406120
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BA9C0 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • FlsGetValue.KERNEL32(?,?,?,00007FF73D7B9BD3,?,?,00000000,00007FF73D7B9E6E,?,?,?,?,?,00007FF73D7B1A40), ref: 00007FF73D7BA9DF
                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF73D7B9BD3,?,?,00000000,00007FF73D7B9E6E,?,?,?,?,?,00007FF73D7B1A40), ref: 00007FF73D7BA9FE
                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF73D7B9BD3,?,?,00000000,00007FF73D7B9E6E,?,?,?,?,?,00007FF73D7B1A40), ref: 00007FF73D7BAA26
                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF73D7B9BD3,?,?,00000000,00007FF73D7B9E6E,?,?,?,?,?,00007FF73D7B1A40), ref: 00007FF73D7BAA37
                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,00007FF73D7B9BD3,?,?,00000000,00007FF73D7B9E6E,?,?,?,?,?,00007FF73D7B1A40), ref: 00007FF73D7BAA48
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Value
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3702945584-0
                                                                                                                                                  • Opcode ID: 358dba81be253043741c53dc9c404725d40e2bf31f5f8457cfbf7a8f66644627
                                                                                                                                                  • Instruction ID: 356adb156fbb5f7645a66488813e76133487a23e6b7052feb4a9ae86f8f117c6
                                                                                                                                                  • Opcode Fuzzy Hash: 358dba81be253043741c53dc9c404725d40e2bf31f5f8457cfbf7a8f66644627
                                                                                                                                                  • Instruction Fuzzy Hash: 13116D21A0C60A61FA5873E55A91179E9426F6C7B0F844334E83E477C6FF6CF441A620
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BA854 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00007FF73D7C24B3,?,?,?,00007FF73D7BCCEC,?,?,00000000,00007FF73D7B386F), ref: 00007FF73D7BA865
                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF73D7C24B3,?,?,?,00007FF73D7BCCEC,?,?,00000000,00007FF73D7B386F), ref: 00007FF73D7BA884
                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF73D7C24B3,?,?,?,00007FF73D7BCCEC,?,?,00000000,00007FF73D7B386F), ref: 00007FF73D7BA8AC
                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF73D7C24B3,?,?,?,00007FF73D7BCCEC,?,?,00000000,00007FF73D7B386F), ref: 00007FF73D7BA8BD
                                                                                                                                                  • FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00007FF73D7C24B3,?,?,?,00007FF73D7BCCEC,?,?,00000000,00007FF73D7B386F), ref: 00007FF73D7BA8CE
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Value
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3702945584-0
                                                                                                                                                  • Opcode ID: 22c838abe64280046e65700e1fb081e145edbc5aabc1c6ea6e91899ef1423157
                                                                                                                                                  • Instruction ID: 8de3d1b6fed6f7159be658053c7715b00672cb8969b6e31aa2b758845f7f88fe
                                                                                                                                                  • Opcode Fuzzy Hash: 22c838abe64280046e65700e1fb081e145edbc5aabc1c6ea6e91899ef1423157
                                                                                                                                                  • Instruction Fuzzy Hash: 70114810E0CA0F61F9AA72E148521B995426F6D370FC80B34E83E4ABC2FF6DB4427231
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BF218 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _invalid_parameter_noinfo
                                                                                                                                                  • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                                                                                                  • API String ID: 3215553584-1196891531
                                                                                                                                                  • Opcode ID: fa9c2c0b9e0b51f4f192ae3b8b8b95ed4a793ff286fdede4dba764f85164dfb1
                                                                                                                                                  • Instruction ID: 81ef92fa8475317c67566f1b768b365ca134620ff95cb475da37eaa53685e9d3
                                                                                                                                                  • Opcode Fuzzy Hash: fa9c2c0b9e0b51f4f192ae3b8b8b95ed4a793ff286fdede4dba764f85164dfb1
                                                                                                                                                  • Instruction Fuzzy Hash: F1819136D0C20AA5F7646FE9C150279F6A0AF29F44FD58071DA0997295EB2EF903B321
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF8A8092000 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 196COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2441062409.00007FF8A8091000.00000040.00000001.01000000.0000001E.sdmp, Offset: 00007FF8A8090000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2441033358.00007FF8A8090000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441062409.00007FF8A80EC000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441062409.00007FF8A8137000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441062409.00007FF8A813B000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441062409.00007FF8A8140000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441062409.00007FF8A8195000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441062409.00007FF8A819B000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441062409.00007FF8A819E000.00000040.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441362670.00007FF8A819F000.00000080.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441390190.00007FF8A81A1000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff8a8090000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: 00007C6126570
                                                                                                                                                  • String ID: CJK UNIFIED IDEOGRAPH-$HANGUL SYLLABLE
                                                                                                                                                  • API String ID: 800424832-87138338
                                                                                                                                                  • Opcode ID: f3d1a0fd07fe994ba10152decafdc21747fdf3a586550f70934b7ddbcfd20b04
                                                                                                                                                  • Instruction ID: d4e61d28e58706d951daa44bc4344f95b52086c0a72060919b1748470170b763
                                                                                                                                                  • Opcode Fuzzy Hash: f3d1a0fd07fe994ba10152decafdc21747fdf3a586550f70934b7ddbcfd20b04
                                                                                                                                                  • Instruction Fuzzy Hash: E5713772B0AE426EEF64CB25A8406BA73A1FF907C4F444231EA6D436D5EF3CD8258754
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7AD468 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CallEncodePointerTranslator
                                                                                                                                                  • String ID: MOC$RCC
                                                                                                                                                  • API String ID: 3544855599-2084237596
                                                                                                                                                  • Opcode ID: f09742bcba9082defbae069630545238114b431a0e4fd7be58dd8469a5d7fef1
                                                                                                                                                  • Instruction ID: e32ea7e34947616c448e8fe8d4fcffbe01d11c99797d9df8b0b78445e995f7f4
                                                                                                                                                  • Opcode Fuzzy Hash: f09742bcba9082defbae069630545238114b431a0e4fd7be58dd8469a5d7fef1
                                                                                                                                                  • Instruction Fuzzy Hash: 6D616A76A08B499AE710EFA5D4803ADB7A0FB48B8CF444225EF4D17B98EF78E055D710
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7AD7C4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                                                                                                  • String ID: csm$csm
                                                                                                                                                  • API String ID: 3896166516-3733052814
                                                                                                                                                  • Opcode ID: a3990994d2fbb822c09bdc2a35b5fa2b647080e9aebb1a5b00e12dffe7bfe986
                                                                                                                                                  • Instruction ID: 6442dccb38bb96ea3a04bbed2afc9502356daac3ec9170fa1eb8f9997e9952ff
                                                                                                                                                  • Opcode Fuzzy Hash: a3990994d2fbb822c09bdc2a35b5fa2b647080e9aebb1a5b00e12dffe7bfe986
                                                                                                                                                  • Instruction Fuzzy Hash: 6551E33290C24AA6EB60AF959444378B7A0FB49B94F884132EA9C47BD5FF3CF450D710
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF8A81B22D9 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 57COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2441450814.00007FF8A81B1000.00000040.00000001.01000000.00000017.sdmp, Offset: 00007FF8A81B0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2441421471.00007FF8A81B0000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A81BD000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8215000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8229000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A823A000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8240000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A824D000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A83F6000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A83F8000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8423000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8454000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A847A000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A84C7000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A84CF000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A84EB000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A84F8000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2442136726.00007FF8A84FC000.00000080.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2442165063.00007FF8A84FE000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff8a81b0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: 00007C6125630
                                                                                                                                                  • String ID: ..\s\crypto\pem\pem_pkey.c$DH PARAMETERS$X9.42 DH PARAMETERS
                                                                                                                                                  • API String ID: 1529501491-3633731555
                                                                                                                                                  • Opcode ID: 238061471d871427c2d5dadc8bac63395304ecb0de6910e9e78e9431ca4b222d
                                                                                                                                                  • Instruction ID: d414d5574a52b3fd890a8389a66b151db8c3ce53e76cd0485dd5cbce2c713ab2
                                                                                                                                                  • Opcode Fuzzy Hash: 238061471d871427c2d5dadc8bac63395304ecb0de6910e9e78e9431ca4b222d
                                                                                                                                                  • Instruction Fuzzy Hash: B121D321A0AA86A2EB11DB55E4001AAF3A4FF947D0F484031EA8C47B55EF7CE544CB24
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7A2CD0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetModuleFileNameW.KERNEL32(?,00007FF73D7A27C9,?,?,?,?,?,?), ref: 00007FF73D7A2D01
                                                                                                                                                    • Part of subcall function 00007FF73D7A1CB0: GetLastError.KERNEL32(?,?,00000000,00007FF73D7A6904,?,?,?,?,?,?,?,?,?,?,?,00007FF73D7A1023), ref: 00007FF73D7A1CD7
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ErrorFileLastModuleName
                                                                                                                                                  • String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
                                                                                                                                                  • API String ID: 2776309574-1977442011
                                                                                                                                                  • Opcode ID: fa74f7d49a5bba7cfca93e60cd70646f34d32484488c9266ff3ae070a385e0ea
                                                                                                                                                  • Instruction ID: 22e7f05a44c0b878c080dcbc08135b3a5094b3faa20fb1b8d8d6afb9ac802d61
                                                                                                                                                  • Opcode Fuzzy Hash: fa74f7d49a5bba7cfca93e60cd70646f34d32484488c9266ff3ae070a385e0ea
                                                                                                                                                  • Instruction Fuzzy Hash: EC017C61B1D64AB5FA61B7A0E8153B59291BF5C3C1FC01032D88E8B396FF1CF254A720
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BBBD0 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2718003287-0
                                                                                                                                                  • Opcode ID: 47f9f7c1e3185106a498671fedee26090088e719dd8e44b73d57f810765c87d4
                                                                                                                                                  • Instruction ID: ae25286e6347ef5d88ca17dee857a11b0038008cae33ad8052fbb896aa10f2b5
                                                                                                                                                  • Opcode Fuzzy Hash: 47f9f7c1e3185106a498671fedee26090088e719dd8e44b73d57f810765c87d4
                                                                                                                                                  • Instruction Fuzzy Hash: 87D10372B0CA8999E711DFB5C4402ACB771FB58B98B804136DE4E97B99EF38E006D710
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7C4DBC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                                                                                                  • String ID: ?
                                                                                                                                                  • API String ID: 1286766494-1684325040
                                                                                                                                                  • Opcode ID: 7a76fc5472fa01dafaf21516cddcde8ab34b2c46cd3e7f8dd598f321934e5d52
                                                                                                                                                  • Instruction ID: 0f513155ee7fa2740f6b051a68b69dd75d8d2a38752f1daea3a4750a8767295f
                                                                                                                                                  • Opcode Fuzzy Hash: 7a76fc5472fa01dafaf21516cddcde8ab34b2c46cd3e7f8dd598f321934e5d52
                                                                                                                                                  • Instruction Fuzzy Hash: 4C414C12A0C68A69FB20ABB5D401379D660EB98BB8F944235EE9D07AD5FF3CF441D710
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF8A81B1DDE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 113COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2441450814.00007FF8A81B1000.00000040.00000001.01000000.00000017.sdmp, Offset: 00007FF8A81B0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2441421471.00007FF8A81B0000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A81BD000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8215000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8229000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A823A000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8240000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A824D000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A83F6000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A83F8000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8423000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8454000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A847A000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A84C7000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A84CF000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A84EB000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A84F8000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2442136726.00007FF8A84FC000.00000080.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2442165063.00007FF8A84FE000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff8a81b0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: getaddrinfo
                                                                                                                                                  • String ID: ..\s\crypto\bio\b_addr.c
                                                                                                                                                  • API String ID: 300660673-2547254400
                                                                                                                                                  • Opcode ID: d8f2f42e3c8b58b55d71bc5e225149b8ac0019e957516eef7570a051d71f3517
                                                                                                                                                  • Instruction ID: 841e91b09a60a83e1af47b7c9f0d1cbc3fe0b8d9a321f770d0a7c25e4d572140
                                                                                                                                                  • Opcode Fuzzy Hash: d8f2f42e3c8b58b55d71bc5e225149b8ac0019e957516eef7570a051d71f3517
                                                                                                                                                  • Instruction Fuzzy Hash: E441E272E1928297E7208F13A445ABE73A1FB847C4F400039FA8A83B49DF3CD845CB54
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7B7FD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • _invalid_parameter_noinfo.LIBCMT ref: 00007FF73D7B8002
                                                                                                                                                    • Part of subcall function 00007FF73D7B9F78: HeapFree.KERNEL32(?,?,?,00007FF73D7C1EC2,?,?,?,00007FF73D7C1EFF,?,?,00000000,00007FF73D7C23C5,?,?,00000000,00007FF73D7C22F7), ref: 00007FF73D7B9F8E
                                                                                                                                                    • Part of subcall function 00007FF73D7B9F78: GetLastError.KERNEL32(?,?,?,00007FF73D7C1EC2,?,?,?,00007FF73D7C1EFF,?,?,00000000,00007FF73D7C23C5,?,?,00000000,00007FF73D7C22F7), ref: 00007FF73D7B9F98
                                                                                                                                                  • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF73D7AA485), ref: 00007FF73D7B8020
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ErrorFileFreeHeapLastModuleName_invalid_parameter_noinfo
                                                                                                                                                  • String ID: C:\Users\user\Desktop\xSO7sbN2j6.exe
                                                                                                                                                  • API String ID: 3580290477-2892895399
                                                                                                                                                  • Opcode ID: 83176ff4db4dd0536c3ddf35c800fe3e17928d2d4ec44ff73abd72510ae6e28f
                                                                                                                                                  • Instruction ID: d77b968abe8ace9e80dce9286fd5fb6461789b5b305ccf334dc3065e768a0ef6
                                                                                                                                                  • Opcode Fuzzy Hash: 83176ff4db4dd0536c3ddf35c800fe3e17928d2d4ec44ff73abd72510ae6e28f
                                                                                                                                                  • Instruction Fuzzy Hash: 24417F36A0CB1AA6E714AF61D8410B8A7A4EF5C7D4BD45035FA4E43B95EF3CF4819360
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BC268 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ErrorFileLastWrite
                                                                                                                                                  • String ID: U
                                                                                                                                                  • API String ID: 442123175-4171548499
                                                                                                                                                  • Opcode ID: 3868b3aae24abb70b6c7ced641cfa87b6d54125405e373b4c87f7bfc476be08b
                                                                                                                                                  • Instruction ID: 9edfc7421728f929e1d956788be6f19ecaa2f95af8da7f4f0660ca1b86ca2057
                                                                                                                                                  • Opcode Fuzzy Hash: 3868b3aae24abb70b6c7ced641cfa87b6d54125405e373b4c87f7bfc476be08b
                                                                                                                                                  • Instruction Fuzzy Hash: D741B422A1CA89A5DB609FA5E8443A9B760FB98794FC44031EE4D87758EF3CE441D750
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF8A81B3E54 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 74COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2441450814.00007FF8A81B1000.00000040.00000001.01000000.00000017.sdmp, Offset: 00007FF8A81B0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2441421471.00007FF8A81B0000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A81BD000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8215000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8229000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A823A000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8240000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A824D000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A83F6000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A83F8000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8423000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8454000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A847A000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A84C7000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A84CF000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A84EB000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A84F8000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2442136726.00007FF8A84FC000.00000080.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2442165063.00007FF8A84FE000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff8a81b0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: 00007C619
                                                                                                                                                  • String ID: ..\s\crypto\rand\randfile.c$Filename=
                                                                                                                                                  • API String ID: 3270680611-2201148535
                                                                                                                                                  • Opcode ID: 7aa9f0ae97a5a607961eb6102bd7d32f256fdfccc8fd4d891701d180c1966ebd
                                                                                                                                                  • Instruction ID: 82025755fcea1dcb222b632cb46abbba1c9f57fef2393f6cc188e6f2518f6488
                                                                                                                                                  • Opcode Fuzzy Hash: 7aa9f0ae97a5a607961eb6102bd7d32f256fdfccc8fd4d891701d180c1966ebd
                                                                                                                                                  • Instruction Fuzzy Hash: F531AE71A0BA46A6EB21DB11E4053F963A5FF84BC8F844036EA4D07795EF3CE549C728
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BE588 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CurrentDirectory
                                                                                                                                                  • String ID: :
                                                                                                                                                  • API String ID: 1611563598-336475711
                                                                                                                                                  • Opcode ID: 69729114f07132f4e5c02582f69e799d97905c52b16ff4e3b4ac21f165a3e13d
                                                                                                                                                  • Instruction ID: 1755fc556a1da28170fabbc13df5f88811531fbffdda114b307d6996ab2c44c4
                                                                                                                                                  • Opcode Fuzzy Hash: 69729114f07132f4e5c02582f69e799d97905c52b16ff4e3b4ac21f165a3e13d
                                                                                                                                                  • Instruction Fuzzy Hash: 8721F222B1C28995EB28AB55D04426DB3B1FB9CB88FC54035D68D43384EF7CF945DB60
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7AE310 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ExceptionFileHeaderRaise
                                                                                                                                                  • String ID: csm
                                                                                                                                                  • API String ID: 2573137834-1018135373
                                                                                                                                                  • Opcode ID: ee4cd62d6736e0f26efa3482034fbaa09f2706f16dc7c85cfdea4997af4e44da
                                                                                                                                                  • Instruction ID: 896f1a36c061e744c92c871ba5f30433224728dfba85e74b9cc71077110cc293
                                                                                                                                                  • Opcode Fuzzy Hash: ee4cd62d6736e0f26efa3482034fbaa09f2706f16dc7c85cfdea4997af4e44da
                                                                                                                                                  • Instruction Fuzzy Hash: E6111C32A1CB4992EB219F55F440269B7A5FB88B94F584231EECD07768EF3CE5519B00
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF73D7BF08C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2440853785.00007FF73D7A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF73D7A0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2440821736.00007FF73D7A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440889498.00007FF73D7CA000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7DD000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7E0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2440921899.00007FF73D7EC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441000945.00007FF73D7EE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff73d7a0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: DriveType_invalid_parameter_noinfo
                                                                                                                                                  • String ID: :
                                                                                                                                                  • API String ID: 2595371189-336475711
                                                                                                                                                  • Opcode ID: 231bdef7d4e4c9a314d514652501e8a1bb3d1d6653b2e53c967e9d93a887682d
                                                                                                                                                  • Instruction ID: 01075045691a855fd7fa22316cf7812ff9c93fe3af67931ac36722cdd7d10247
                                                                                                                                                  • Opcode Fuzzy Hash: 231bdef7d4e4c9a314d514652501e8a1bb3d1d6653b2e53c967e9d93a887682d
                                                                                                                                                  • Instruction Fuzzy Hash: 67017161A1C60A96E720BFE0946127EE3A0EF5DB04FC40036D58D86691FF2DF545A634
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00007FF8A81B344F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000003.00000002.2441450814.00007FF8A81B1000.00000040.00000001.01000000.00000017.sdmp, Offset: 00007FF8A81B0000, based on PE: true
                                                                                                                                                  • Associated: 00000003.00000002.2441421471.00007FF8A81B0000.00000002.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A81BD000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8215000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8229000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A823A000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8240000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A824D000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A83F6000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A83F8000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8423000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A8454000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A847A000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A84C7000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A84CF000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A84EB000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2441450814.00007FF8A84F8000.00000040.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2442136726.00007FF8A84FC000.00000080.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  • Associated: 00000003.00000002.2442165063.00007FF8A84FE000.00000004.00000001.01000000.00000017.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_3_2_7ff8a81b0000_xSO7sbN2j6.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: 00007C61208
                                                                                                                                                  • String ID: !$..\s\crypto\ct\ct_policy.c
                                                                                                                                                  • API String ID: 3535234312-3401457818
                                                                                                                                                  • Opcode ID: 7dd7914ea23ad579c57b6056f7cce2880690e26ce5683a11da2da96350132182
                                                                                                                                                  • Instruction ID: af3d6229d2a5fd7bca348e43c8beeabbec387ca24ff4822c7465df6e0341e933
                                                                                                                                                  • Opcode Fuzzy Hash: 7dd7914ea23ad579c57b6056f7cce2880690e26ce5683a11da2da96350132182
                                                                                                                                                  • Instruction Fuzzy Hash: 8DF04971A17606AAEB169B24E40A7ED6394FF44788F440534DA0D423D1EF3CA656C728
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Execution Graph

                                                                                                                                                  Execution Coverage:1.4%
                                                                                                                                                  Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                  Signature Coverage:0%
                                                                                                                                                  Total number of Nodes:1521
                                                                                                                                                  Total number of Limit Nodes:32
                                                                                                                                                  execution_graph 13589 a0c523 13590 a0c53e 13589->13590 13591 a0c52e 13589->13591 13595 a0c544 13591->13595 13594 a0a55f ___free_lconv_mon 14 API calls 13594->13590 13596 a0c55f 13595->13596 13597 a0c559 13595->13597 13599 a0a55f ___free_lconv_mon 14 API calls 13596->13599 13598 a0a55f ___free_lconv_mon 14 API calls 13597->13598 13598->13596 13600 a0c56b 13599->13600 13601 a0a55f ___free_lconv_mon 14 API calls 13600->13601 13602 a0c576 13601->13602 13603 a0a55f ___free_lconv_mon 14 API calls 13602->13603 13604 a0c581 13603->13604 13605 a0a55f ___free_lconv_mon 14 API calls 13604->13605 13606 a0c58c 13605->13606 13607 a0a55f ___free_lconv_mon 14 API calls 13606->13607 13608 a0c597 13607->13608 13609 a0a55f ___free_lconv_mon 14 API calls 13608->13609 13610 a0c5a2 13609->13610 13611 a0a55f ___free_lconv_mon 14 API calls 13610->13611 13612 a0c5ad 13611->13612 13613 a0a55f ___free_lconv_mon 14 API calls 13612->13613 13614 a0c5b8 13613->13614 13615 a0a55f ___free_lconv_mon 14 API calls 13614->13615 13616 a0c5c6 13615->13616 13621 a0c370 13616->13621 13622 a0c37c ___scrt_is_nonwritable_in_current_image 13621->13622 13637 a0c988 RtlEnterCriticalSection 13622->13637 13624 a0c3b0 13638 a0c3cf 13624->13638 13625 a0c386 13625->13624 13628 a0a55f ___free_lconv_mon 14 API calls 13625->13628 13628->13624 13629 a0c3db 13630 a0c3e7 ___scrt_is_nonwritable_in_current_image 13629->13630 13642 a0c988 RtlEnterCriticalSection 13630->13642 13632 a0c3f1 13633 a0c611 _unexpected 14 API calls 13632->13633 13634 a0c404 13633->13634 13643 a0c424 13634->13643 13637->13625 13641 a0c9d0 RtlLeaveCriticalSection 13638->13641 13640 a0c3bd 13640->13629 13641->13640 13642->13632 13646 a0c9d0 RtlLeaveCriticalSection 13643->13646 13645 a0c412 13645->13594 13646->13645 13660 a0af30 13661 a0af3c ___scrt_is_nonwritable_in_current_image 13660->13661 13672 a0c988 RtlEnterCriticalSection 13661->13672 13663 a0af43 13673 a0e415 13663->13673 13666 a0af61 13692 a0af87 13666->13692 13671 a0ae80 2 API calls 13671->13666 13672->13663 13674 a0e421 ___scrt_is_nonwritable_in_current_image 13673->13674 13675 a0e42a 13674->13675 13676 a0e44b 13674->13676 13677 a0a4ef __strnicoll 14 API calls 13675->13677 13695 a0c988 RtlEnterCriticalSection 13676->13695 13679 a0e42f 13677->13679 13680 a08fd0 __strnicoll 41 API calls 13679->13680 13681 a0af52 13680->13681 13681->13666 13686 a0adca GetStartupInfoW 13681->13686 13682 a0e483 13703 a0e4aa 13682->13703 13684 a0e457 13684->13682 13696 a0e365 13684->13696 13687 a0ade7 13686->13687 13688 a0ae7b 13686->13688 13687->13688 13689 a0e415 42 API calls 13687->13689 13688->13671 13690 a0ae0f 13689->13690 13690->13688 13691 a0ae3f GetFileType 13690->13691 13691->13690 13707 a0c9d0 RtlLeaveCriticalSection 13692->13707 13694 a0af72 13695->13684 13697 a0a502 _unexpected 14 API calls 13696->13697 13698 a0e377 13697->13698 13701 a0a90c 6 API calls 13698->13701 13702 a0e384 13698->13702 13699 a0a55f ___free_lconv_mon 14 API calls 13700 a0e3d9 13699->13700 13700->13684 13701->13698 13702->13699 13706 a0c9d0 RtlLeaveCriticalSection 13703->13706 13705 a0e4b1 13705->13681 13706->13705 13707->13694 13109 a0edb4 13110 a0edcd 13109->13110 13111 a0edeb 13109->13111 13110->13111 13112 a0ae80 2 API calls 13110->13112 13112->13110 12643 a036b5 12644 a036bd 12643->12644 12660 a09c14 12644->12660 12646 a036c8 12667 a03af9 12646->12667 12648 a03dae 4 API calls 12649 a0375f 12648->12649 12650 a036dd __RTC_Initialize 12658 a0373a 12650->12658 12673 a03c86 12650->12673 12652 a036f6 12652->12658 12676 a03d40 RtlInitializeSListHead 12652->12676 12654 a0370c 12677 a03d4f 12654->12677 12656 a0372f 12683 a09d16 12656->12683 12658->12648 12659 a03757 12658->12659 12661 a09c23 12660->12661 12662 a09c46 12660->12662 12661->12662 12663 a0a4ef __strnicoll 14 API calls 12661->12663 12662->12646 12664 a09c36 12663->12664 12665 a08fd0 __strnicoll 41 API calls 12664->12665 12666 a09c41 12665->12666 12666->12646 12668 a03b05 12667->12668 12669 a03b09 12667->12669 12668->12650 12670 a03dae 4 API calls 12669->12670 12672 a03b16 ___scrt_release_startup_lock 12669->12672 12671 a03b7f 12670->12671 12672->12650 12690 a03c59 12673->12690 12676->12654 12753 a0a24e 12677->12753 12679 a03d60 12680 a03d67 12679->12680 12681 a03dae 4 API calls 12679->12681 12680->12656 12682 a03d6f 12681->12682 12684 a0c65c _unexpected 41 API calls 12683->12684 12685 a09d21 12684->12685 12686 a0a4ef __strnicoll 14 API calls 12685->12686 12689 a09d59 12685->12689 12687 a09d4e 12686->12687 12688 a08fd0 __strnicoll 41 API calls 12687->12688 12688->12689 12689->12658 12691 a03c68 12690->12691 12692 a03c6f 12690->12692 12696 a0a061 12691->12696 12699 a0a0de 12692->12699 12695 a03c6d 12695->12652 12697 a0a0de 44 API calls 12696->12697 12698 a0a073 12697->12698 12698->12695 12702 a09e2a 12699->12702 12703 a09e36 ___scrt_is_nonwritable_in_current_image 12702->12703 12710 a0c988 RtlEnterCriticalSection 12703->12710 12705 a09e44 12711 a09e85 12705->12711 12707 a09e51 12721 a09e79 12707->12721 12710->12705 12712 a09ea0 12711->12712 12720 a09f13 _unexpected 12711->12720 12719 a09ef3 12712->12719 12712->12720 12724 a0ed35 12712->12724 12713 a0ed35 44 API calls 12715 a09f09 12713->12715 12718 a0a55f ___free_lconv_mon 14 API calls 12715->12718 12716 a09ee9 12717 a0a55f ___free_lconv_mon 14 API calls 12716->12717 12717->12719 12718->12720 12719->12713 12719->12720 12720->12707 12752 a0c9d0 RtlLeaveCriticalSection 12721->12752 12723 a09e62 12723->12695 12725 a0ed42 12724->12725 12726 a0ed5d 12724->12726 12725->12726 12728 a0ed4e 12725->12728 12727 a0ed6c 12726->12727 12733 a13020 12726->12733 12740 a13053 12727->12740 12730 a0a4ef __strnicoll 14 API calls 12728->12730 12732 a0ed53 CallUnexpected 12730->12732 12732->12716 12734 a13040 RtlSizeHeap 12733->12734 12735 a1302b 12733->12735 12734->12727 12736 a0a4ef __strnicoll 14 API calls 12735->12736 12737 a13030 12736->12737 12738 a08fd0 __strnicoll 41 API calls 12737->12738 12739 a1303b 12738->12739 12739->12727 12741 a13060 12740->12741 12742 a1306b 12740->12742 12743 a0afbc __strnicoll 15 API calls 12741->12743 12744 a13073 12742->12744 12751 a1307c _unexpected 12742->12751 12749 a13068 12743->12749 12747 a0a55f ___free_lconv_mon 14 API calls 12744->12747 12745 a13081 12748 a0a4ef __strnicoll 14 API calls 12745->12748 12746 a130a6 RtlReAllocateHeap 12746->12749 12746->12751 12747->12749 12748->12749 12749->12732 12750 a09066 _unexpected 2 API calls 12750->12751 12751->12745 12751->12746 12751->12750 12752->12723 12754 a0a26c 12753->12754 12758 a0a28c 12753->12758 12755 a0a4ef __strnicoll 14 API calls 12754->12755 12756 a0a282 12755->12756 12757 a08fd0 __strnicoll 41 API calls 12756->12757 12757->12758 12758->12679 13468 a06598 13469 a0ad81 ___scrt_uninitialize_crt 70 API calls 13468->13469 13470 a065a0 13469->13470 13478 a0aa2f 13470->13478 13472 a065a5 13488 a0ad8a 13472->13488 13475 a065cf 13476 a0a55f ___free_lconv_mon 14 API calls 13475->13476 13477 a065da 13476->13477 13479 a0aa3b ___scrt_is_nonwritable_in_current_image 13478->13479 13492 a0c988 RtlEnterCriticalSection 13479->13492 13481 a0aab2 13499 a0aad1 13481->13499 13482 a0aa46 13482->13481 13484 a0aa86 RtlDeleteCriticalSection 13482->13484 13493 a0f824 13482->13493 13487 a0a55f ___free_lconv_mon 14 API calls 13484->13487 13487->13482 13489 a0ada1 13488->13489 13490 a065b4 RtlDeleteCriticalSection 13488->13490 13489->13490 13491 a0a55f ___free_lconv_mon 14 API calls 13489->13491 13490->13472 13490->13475 13491->13490 13492->13482 13494 a0f837 __strnicoll 13493->13494 13502 a0f6ff 13494->13502 13496 a0f843 13497 a07390 __strnicoll 41 API calls 13496->13497 13498 a0f84f 13497->13498 13498->13482 13574 a0c9d0 RtlLeaveCriticalSection 13499->13574 13501 a0aabe 13501->13472 13503 a0f70b ___scrt_is_nonwritable_in_current_image 13502->13503 13504 a0f715 13503->13504 13505 a0f738 13503->13505 13506 a08f53 __strnicoll 29 API calls 13504->13506 13512 a0f730 13505->13512 13513 a065e4 RtlEnterCriticalSection 13505->13513 13506->13512 13508 a0f756 13514 a0f796 13508->13514 13510 a0f763 13528 a0f78e 13510->13528 13512->13496 13513->13508 13515 a0f7a3 13514->13515 13516 a0f7c6 13514->13516 13517 a08f53 __strnicoll 29 API calls 13515->13517 13518 a0acb3 ___scrt_uninitialize_crt 66 API calls 13516->13518 13526 a0f7be 13516->13526 13517->13526 13519 a0f7de 13518->13519 13520 a0ad8a 14 API calls 13519->13520 13521 a0f7e6 13520->13521 13522 a0c18e ___scrt_uninitialize_crt 41 API calls 13521->13522 13523 a0f7f2 13522->13523 13531 a13271 13523->13531 13526->13510 13527 a0a55f ___free_lconv_mon 14 API calls 13527->13526 13573 a065f8 RtlLeaveCriticalSection 13528->13573 13530 a0f794 13530->13512 13533 a1329a 13531->13533 13537 a0f7f9 13531->13537 13532 a132e9 13534 a08f53 __strnicoll 29 API calls 13532->13534 13533->13532 13535 a132c1 13533->13535 13534->13537 13538 a131e0 13535->13538 13537->13526 13537->13527 13539 a131ec ___scrt_is_nonwritable_in_current_image 13538->13539 13546 a0e4b3 RtlEnterCriticalSection 13539->13546 13541 a131fa 13542 a1322b 13541->13542 13547 a13314 13541->13547 13560 a13265 13542->13560 13546->13541 13548 a0e58a ___scrt_uninitialize_crt 41 API calls 13547->13548 13551 a13324 13548->13551 13549 a1332a 13563 a0e4f9 13549->13563 13551->13549 13553 a0e58a ___scrt_uninitialize_crt 41 API calls 13551->13553 13559 a1335c 13551->13559 13552 a0e58a ___scrt_uninitialize_crt 41 API calls 13554 a13368 CloseHandle 13552->13554 13555 a13353 13553->13555 13554->13549 13556 a13374 GetLastError 13554->13556 13557 a0e58a ___scrt_uninitialize_crt 41 API calls 13555->13557 13556->13549 13557->13559 13558 a13382 ___scrt_uninitialize_crt 13558->13542 13559->13549 13559->13552 13572 a0e4d6 RtlLeaveCriticalSection 13560->13572 13562 a1324e 13562->13537 13564 a0e508 13563->13564 13565 a0e56f 13563->13565 13564->13565 13571 a0e532 13564->13571 13566 a0a4ef __strnicoll 14 API calls 13565->13566 13567 a0e574 13566->13567 13568 a0a4dc __dosmaperr 14 API calls 13567->13568 13569 a0e55f 13568->13569 13569->13558 13570 a0e559 SetStdHandle 13570->13569 13571->13569 13571->13570 13572->13562 13573->13530 13574->13501 12841 a09cef 12844 a09c76 12841->12844 12845 a09c82 ___scrt_is_nonwritable_in_current_image 12844->12845 12852 a0c988 RtlEnterCriticalSection 12845->12852 12847 a09cba 12853 a09cd8 12847->12853 12849 a09c8c 12849->12847 12851 a0ece5 __strnicoll 14 API calls 12849->12851 12851->12849 12852->12849 12856 a0c9d0 RtlLeaveCriticalSection 12853->12856 12855 a09cc6 12856->12855 10811 a0377a 10812 a03786 ___scrt_is_nonwritable_in_current_image 10811->10812 10839 a03ac0 10812->10839 10814 a0378d 10815 a038e6 10814->10815 10827 a037b7 ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock CallUnexpected 10814->10827 10907 a03dae IsProcessorFeaturePresent 10815->10907 10817 a038ed 10818 a038f3 10817->10818 10887 a09bfe 10817->10887 10911 a09bc2 10818->10911 10824 a037d6 10825 a03857 10850 a0988b 10825->10850 10827->10824 10827->10825 10890 a09bd8 10827->10890 10829 a0385d 10854 a01260 CoInitialize 10829->10854 10834 a03882 10835 a0388b 10834->10835 10898 a09bb3 10834->10898 10901 a03c31 10835->10901 10840 a03ac9 10839->10840 10918 a04035 IsProcessorFeaturePresent 10840->10918 10844 a03ada 10849 a03ade 10844->10849 10928 a0a20c 10844->10928 10846 a03af5 10846->10814 10849->10814 10851 a09894 10850->10851 10852 a09899 10850->10852 11000 a095e5 10851->11000 10852->10829 10855 a012b7 10854->10855 10856 a012cf 10854->10856 11665 a01010 10855->11665 10858 a0130c 10856->10858 10859 a012ee 10856->10859 10863 a01325 10858->10863 10864 a0134f 10858->10864 10860 a01010 72 API calls 10859->10860 10873 a012c2 10860->10873 10861 a03646 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 10862 a02dfe 10861->10862 10896 a03ece GetModuleHandleW 10862->10896 10865 a01010 72 API calls 10863->10865 11648 a02fe0 10864->11648 10865->10873 10867 a02d27 10870 a02d36 10867->10870 11669 a030f0 10867->11669 10869 a01010 72 API calls 10883 a0135c __InternalCxxFrameHandler 10869->10883 10871 a01010 72 API calls 10870->10871 10872 a02db2 10871->10872 10872->10873 10874 a02e02 10872->10874 10873->10861 11684 a08fe0 10874->11684 10877 a011e0 47 API calls 10877->10883 10881 a02e70 47 API calls 10881->10883 10882 a03250 47 API calls 10882->10883 10883->10867 10883->10869 10883->10874 10883->10877 10883->10881 10883->10882 10884 a02fe0 47 API calls 10883->10884 10885 a03430 47 API calls 10883->10885 10886 a030f0 47 API calls 10883->10886 10884->10883 10885->10883 10886->10883 12201 a09a32 10887->12201 10891 a09bee ___scrt_is_nonwritable_in_current_image _unexpected 10890->10891 10891->10825 10892 a0c65c _unexpected 41 API calls 10891->10892 10893 a0a2be 10892->10893 10894 a0a2e9 CallUnexpected 41 API calls 10893->10894 10895 a0a2e8 10894->10895 10897 a0387e 10896->10897 10897->10817 10897->10834 10899 a09a32 CallUnexpected 21 API calls 10898->10899 10900 a09bbe 10899->10900 10900->10835 10902 a03c3d 10901->10902 10906 a03894 10902->10906 12274 a0a21e 10902->12274 10904 a03c4b 10905 a04a3d ___scrt_uninitialize_crt 7 API calls 10904->10905 10905->10906 10906->10824 10908 a03dc4 CallUnexpected 10907->10908 10909 a03e6f IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 10908->10909 10910 a03eba CallUnexpected 10909->10910 10910->10817 10912 a09a32 CallUnexpected 21 API calls 10911->10912 10913 a038fb 10912->10913 10914 a03ce8 10913->10914 10915 a03cfe 10914->10915 10917 a03901 __scrt_common_main_seh 10915->10917 12368 a03c9b GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter 10915->12368 10919 a03ad5 10918->10919 10920 a04a1e 10919->10920 10937 a05c27 10920->10937 10924 a04a2f 10925 a04a3a 10924->10925 10951 a05c63 10924->10951 10925->10844 10927 a04a27 10927->10844 10991 a0edbd 10928->10991 10931 a04a3d 10932 a04a50 10931->10932 10933 a04a46 10931->10933 10932->10849 10934 a04cd9 ___vcrt_uninitialize_ptd 6 API calls 10933->10934 10935 a04a4b 10934->10935 10936 a05c63 ___vcrt_uninitialize_locks RtlDeleteCriticalSection 10935->10936 10936->10932 10938 a05c30 10937->10938 10940 a05c59 10938->10940 10941 a04a23 10938->10941 10955 a05e6c 10938->10955 10942 a05c63 ___vcrt_uninitialize_locks RtlDeleteCriticalSection 10940->10942 10941->10927 10943 a04ca6 10941->10943 10942->10941 10972 a05d7d 10943->10972 10946 a04cbb 10946->10924 10949 a04cd6 10949->10924 10952 a05c8d 10951->10952 10953 a05c6e 10951->10953 10952->10927 10954 a05c78 RtlDeleteCriticalSection 10953->10954 10954->10952 10954->10954 10960 a05c92 10955->10960 10958 a05ea4 InitializeCriticalSectionAndSpinCount 10959 a05e8f 10958->10959 10959->10938 10961 a05cb3 10960->10961 10962 a05caf 10960->10962 10961->10962 10963 a05d1b GetProcAddress 10961->10963 10965 a05d0c 10961->10965 10967 a05d32 LoadLibraryExW 10961->10967 10962->10958 10962->10959 10963->10962 10965->10963 10966 a05d14 FreeLibrary 10965->10966 10966->10963 10968 a05d49 GetLastError 10967->10968 10969 a05d79 10967->10969 10968->10969 10970 a05d54 ___vcrt_FlsGetValue 10968->10970 10969->10961 10970->10969 10971 a05d6a LoadLibraryExW 10970->10971 10971->10961 10973 a05c92 ___vcrt_FlsGetValue 5 API calls 10972->10973 10974 a05d97 10973->10974 10975 a05db0 TlsAlloc 10974->10975 10976 a04cb0 10974->10976 10976->10946 10977 a05e2e 10976->10977 10978 a05c92 ___vcrt_FlsGetValue 5 API calls 10977->10978 10979 a05e48 10978->10979 10980 a05e63 TlsSetValue 10979->10980 10981 a04cc9 10979->10981 10980->10981 10981->10949 10982 a04cd9 10981->10982 10983 a04ce9 10982->10983 10984 a04ce3 10982->10984 10983->10946 10986 a05db8 10984->10986 10987 a05c92 ___vcrt_FlsGetValue 5 API calls 10986->10987 10988 a05dd2 10987->10988 10989 a05dea TlsFree 10988->10989 10990 a05dde 10988->10990 10989->10990 10990->10983 10992 a0edcd 10991->10992 10993 a03ae7 10991->10993 10992->10993 10995 a0ae80 10992->10995 10993->10846 10993->10931 10996 a0ae87 10995->10996 10997 a0aeca GetStdHandle 10996->10997 10998 a0af2c 10996->10998 10999 a0aedd GetFileType 10996->10999 10997->10996 10998->10992 10999->10996 11001 a095ee 11000->11001 11004 a09604 11000->11004 11001->11004 11006 a09611 11001->11006 11003 a095fb 11003->11004 11023 a0977c 11003->11023 11004->10852 11007 a0961a 11006->11007 11008 a0961d 11006->11008 11007->11003 11031 a0d9b1 11008->11031 11013 a0963a 11064 a0966b 11013->11064 11014 a0962e 11058 a0a55f 11014->11058 11019 a0a55f ___free_lconv_mon 14 API calls 11020 a0965e 11019->11020 11021 a0a55f ___free_lconv_mon 14 API calls 11020->11021 11022 a09664 11021->11022 11022->11003 11024 a097ed 11023->11024 11030 a0978b 11023->11030 11024->11004 11025 a0a502 _unexpected 14 API calls 11025->11030 11026 a097f1 11027 a0a55f ___free_lconv_mon 14 API calls 11026->11027 11027->11024 11028 a0de4c WideCharToMultiByte ___scrt_uninitialize_crt 11028->11030 11029 a0a55f ___free_lconv_mon 14 API calls 11029->11030 11030->11024 11030->11025 11030->11026 11030->11028 11030->11029 11032 a09623 11031->11032 11033 a0d9ba 11031->11033 11037 a0deef GetEnvironmentStringsW 11032->11037 11086 a0c717 11033->11086 11038 a0df07 11037->11038 11043 a09628 11037->11043 11039 a0de4c ___scrt_uninitialize_crt WideCharToMultiByte 11038->11039 11040 a0df24 11039->11040 11041 a0df39 11040->11041 11042 a0df2e FreeEnvironmentStringsW 11040->11042 11044 a0afbc __strnicoll 15 API calls 11041->11044 11042->11043 11043->11013 11043->11014 11045 a0df40 11044->11045 11046 a0df48 11045->11046 11047 a0df59 11045->11047 11048 a0a55f ___free_lconv_mon 14 API calls 11046->11048 11049 a0de4c ___scrt_uninitialize_crt WideCharToMultiByte 11047->11049 11050 a0df4d FreeEnvironmentStringsW 11048->11050 11051 a0df69 11049->11051 11050->11043 11052 a0df70 11051->11052 11053 a0df78 11051->11053 11054 a0a55f ___free_lconv_mon 14 API calls 11052->11054 11055 a0a55f ___free_lconv_mon 14 API calls 11053->11055 11056 a0df76 FreeEnvironmentStringsW 11054->11056 11055->11056 11056->11043 11059 a09634 11058->11059 11060 a0a56a HeapFree 11058->11060 11059->11003 11060->11059 11061 a0a57f GetLastError 11060->11061 11062 a0a58c __dosmaperr 11061->11062 11063 a0a4ef __strnicoll 12 API calls 11062->11063 11063->11059 11065 a09680 11064->11065 11066 a0a502 _unexpected 14 API calls 11065->11066 11067 a096a7 11066->11067 11068 a096af 11067->11068 11077 a096b9 11067->11077 11069 a0a55f ___free_lconv_mon 14 API calls 11068->11069 11085 a09641 11069->11085 11070 a09716 11071 a0a55f ___free_lconv_mon 14 API calls 11070->11071 11071->11085 11072 a0a502 _unexpected 14 API calls 11072->11077 11073 a09725 11638 a0974d 11073->11638 11077->11070 11077->11072 11077->11073 11079 a09740 11077->11079 11081 a0a55f ___free_lconv_mon 14 API calls 11077->11081 11629 a0a32d 11077->11629 11078 a0a55f ___free_lconv_mon 14 API calls 11080 a09732 11078->11080 11644 a08ffd IsProcessorFeaturePresent 11079->11644 11083 a0a55f ___free_lconv_mon 14 API calls 11080->11083 11081->11077 11083->11085 11084 a0974c 11085->11019 11087 a0c722 11086->11087 11088 a0c728 11086->11088 11134 a0a88b 11087->11134 11106 a0c72e 11088->11106 11139 a0a8ca 11088->11139 11096 a0c75a 11099 a0a8ca _unexpected 6 API calls 11096->11099 11097 a0c76f 11098 a0a8ca _unexpected 6 API calls 11097->11098 11100 a0c77b 11098->11100 11107 a0c766 11099->11107 11101 a0c78e 11100->11101 11102 a0c77f 11100->11102 11151 a0c48a 11101->11151 11104 a0a8ca _unexpected 6 API calls 11102->11104 11103 a0a55f ___free_lconv_mon 14 API calls 11103->11106 11104->11107 11110 a0c733 11106->11110 11156 a0a2e9 11106->11156 11107->11103 11109 a0a55f ___free_lconv_mon 14 API calls 11109->11110 11111 a0d7bc 11110->11111 11435 a0d911 11111->11435 11116 a0d7ff 11116->11032 11119 a0d826 11460 a0da0c 11119->11460 11120 a0d818 11121 a0a55f ___free_lconv_mon 14 API calls 11120->11121 11121->11116 11124 a0d85e 11125 a0a4ef __strnicoll 14 API calls 11124->11125 11126 a0d863 11125->11126 11128 a0a55f ___free_lconv_mon 14 API calls 11126->11128 11127 a0d8a5 11130 a0d8ee 11127->11130 11471 a0d435 11127->11471 11128->11116 11129 a0d879 11129->11127 11133 a0a55f ___free_lconv_mon 14 API calls 11129->11133 11132 a0a55f ___free_lconv_mon 14 API calls 11130->11132 11132->11116 11133->11127 11167 a0a6cc 11134->11167 11136 a0a8a7 11137 a0a8b0 11136->11137 11138 a0a8c2 TlsGetValue 11136->11138 11137->11088 11140 a0a6cc _unexpected 5 API calls 11139->11140 11141 a0a8e6 11140->11141 11142 a0a904 TlsSetValue 11141->11142 11143 a0a8ef 11141->11143 11143->11106 11144 a0a502 11143->11144 11149 a0a50f _unexpected 11144->11149 11145 a0a54f 11184 a0a4ef 11145->11184 11146 a0a53a RtlAllocateHeap 11147 a0a54d 11146->11147 11146->11149 11147->11096 11147->11097 11149->11145 11149->11146 11181 a09066 11149->11181 11221 a0c31e 11151->11221 11323 a0ef28 11156->11323 11159 a0a2f9 11161 a0a303 IsProcessorFeaturePresent 11159->11161 11166 a0a322 11159->11166 11162 a0a30f 11161->11162 11353 a08dd4 11162->11353 11163 a09bc2 CallUnexpected 21 API calls 11165 a0a32c 11163->11165 11166->11163 11168 a0a6fc 11167->11168 11172 a0a6f8 _unexpected 11167->11172 11168->11172 11173 a0a601 11168->11173 11171 a0a716 GetProcAddress 11171->11172 11172->11136 11178 a0a612 ___vcrt_FlsGetValue 11173->11178 11174 a0a6a8 11174->11171 11174->11172 11175 a0a630 LoadLibraryExW 11176 a0a64b GetLastError 11175->11176 11177 a0a6af 11175->11177 11176->11178 11177->11174 11179 a0a6c1 FreeLibrary 11177->11179 11178->11174 11178->11175 11180 a0a67e LoadLibraryExW 11178->11180 11179->11174 11180->11177 11180->11178 11187 a09092 11181->11187 11198 a0c7ad GetLastError 11184->11198 11186 a0a4f4 11186->11147 11188 a0909e ___scrt_is_nonwritable_in_current_image 11187->11188 11193 a0c988 RtlEnterCriticalSection 11188->11193 11190 a090a9 CallUnexpected 11194 a090e0 11190->11194 11193->11190 11197 a0c9d0 RtlLeaveCriticalSection 11194->11197 11196 a09071 11196->11149 11197->11196 11199 a0c7c3 11198->11199 11200 a0c7c9 11198->11200 11202 a0a88b _unexpected 6 API calls 11199->11202 11201 a0a8ca _unexpected 6 API calls 11200->11201 11204 a0c7cd SetLastError 11200->11204 11203 a0c7e5 11201->11203 11202->11200 11203->11204 11206 a0a502 _unexpected 12 API calls 11203->11206 11204->11186 11207 a0c7fa 11206->11207 11208 a0c802 11207->11208 11209 a0c813 11207->11209 11210 a0a8ca _unexpected 6 API calls 11208->11210 11211 a0a8ca _unexpected 6 API calls 11209->11211 11212 a0c810 11210->11212 11213 a0c81f 11211->11213 11217 a0a55f ___free_lconv_mon 12 API calls 11212->11217 11214 a0c823 11213->11214 11215 a0c83a 11213->11215 11216 a0a8ca _unexpected 6 API calls 11214->11216 11218 a0c48a _unexpected 12 API calls 11215->11218 11216->11212 11217->11204 11219 a0c845 11218->11219 11220 a0a55f ___free_lconv_mon 12 API calls 11219->11220 11220->11204 11222 a0c32a ___scrt_is_nonwritable_in_current_image 11221->11222 11235 a0c988 RtlEnterCriticalSection 11222->11235 11224 a0c334 11236 a0c364 11224->11236 11227 a0c430 11228 a0c43c ___scrt_is_nonwritable_in_current_image 11227->11228 11240 a0c988 RtlEnterCriticalSection 11228->11240 11230 a0c446 11241 a0c611 11230->11241 11232 a0c45e 11245 a0c47e 11232->11245 11235->11224 11239 a0c9d0 RtlLeaveCriticalSection 11236->11239 11238 a0c352 11238->11227 11239->11238 11240->11230 11242 a0c647 _unexpected 11241->11242 11243 a0c620 _unexpected 11241->11243 11242->11232 11243->11242 11248 a0ea18 11243->11248 11322 a0c9d0 RtlLeaveCriticalSection 11245->11322 11247 a0c46c 11247->11109 11249 a0ea98 11248->11249 11252 a0ea2e 11248->11252 11250 a0eae6 11249->11250 11253 a0a55f ___free_lconv_mon 14 API calls 11249->11253 11316 a0eb89 11250->11316 11252->11249 11254 a0ea61 11252->11254 11259 a0a55f ___free_lconv_mon 14 API calls 11252->11259 11255 a0eaba 11253->11255 11256 a0ea83 11254->11256 11264 a0a55f ___free_lconv_mon 14 API calls 11254->11264 11257 a0a55f ___free_lconv_mon 14 API calls 11255->11257 11258 a0a55f ___free_lconv_mon 14 API calls 11256->11258 11260 a0eacd 11257->11260 11261 a0ea8d 11258->11261 11263 a0ea56 11259->11263 11265 a0a55f ___free_lconv_mon 14 API calls 11260->11265 11266 a0a55f ___free_lconv_mon 14 API calls 11261->11266 11262 a0eb54 11267 a0a55f ___free_lconv_mon 14 API calls 11262->11267 11276 a0e60a 11263->11276 11269 a0ea78 11264->11269 11270 a0eadb 11265->11270 11266->11249 11272 a0eb5a 11267->11272 11304 a0e708 11269->11304 11275 a0a55f ___free_lconv_mon 14 API calls 11270->11275 11271 a0a55f 14 API calls ___free_lconv_mon 11273 a0eaf4 11271->11273 11272->11242 11273->11262 11273->11271 11275->11250 11277 a0e704 11276->11277 11278 a0e61b 11276->11278 11277->11254 11279 a0e62c 11278->11279 11280 a0a55f ___free_lconv_mon 14 API calls 11278->11280 11281 a0e63e 11279->11281 11282 a0a55f ___free_lconv_mon 14 API calls 11279->11282 11280->11279 11283 a0e650 11281->11283 11284 a0a55f ___free_lconv_mon 14 API calls 11281->11284 11282->11281 11285 a0e662 11283->11285 11286 a0a55f ___free_lconv_mon 14 API calls 11283->11286 11284->11283 11287 a0e674 11285->11287 11288 a0a55f ___free_lconv_mon 14 API calls 11285->11288 11286->11285 11289 a0e686 11287->11289 11290 a0a55f ___free_lconv_mon 14 API calls 11287->11290 11288->11287 11291 a0e698 11289->11291 11292 a0a55f ___free_lconv_mon 14 API calls 11289->11292 11290->11289 11293 a0e6aa 11291->11293 11294 a0a55f ___free_lconv_mon 14 API calls 11291->11294 11292->11291 11295 a0e6bc 11293->11295 11296 a0a55f ___free_lconv_mon 14 API calls 11293->11296 11294->11293 11297 a0e6ce 11295->11297 11298 a0a55f ___free_lconv_mon 14 API calls 11295->11298 11296->11295 11299 a0e6e0 11297->11299 11300 a0a55f ___free_lconv_mon 14 API calls 11297->11300 11298->11297 11301 a0e6f2 11299->11301 11302 a0a55f ___free_lconv_mon 14 API calls 11299->11302 11300->11299 11301->11277 11303 a0a55f ___free_lconv_mon 14 API calls 11301->11303 11302->11301 11303->11277 11305 a0e715 11304->11305 11306 a0e76d 11304->11306 11307 a0e725 11305->11307 11308 a0a55f ___free_lconv_mon 14 API calls 11305->11308 11306->11256 11309 a0e737 11307->11309 11310 a0a55f ___free_lconv_mon 14 API calls 11307->11310 11308->11307 11311 a0e749 11309->11311 11312 a0a55f ___free_lconv_mon 14 API calls 11309->11312 11310->11309 11313 a0e75b 11311->11313 11314 a0a55f ___free_lconv_mon 14 API calls 11311->11314 11312->11311 11313->11306 11315 a0a55f ___free_lconv_mon 14 API calls 11313->11315 11314->11313 11315->11306 11317 a0eb96 11316->11317 11321 a0ebb5 11316->11321 11318 a0e796 _unexpected 14 API calls 11317->11318 11317->11321 11319 a0ebaf 11318->11319 11320 a0a55f ___free_lconv_mon 14 API calls 11319->11320 11320->11321 11321->11273 11322->11247 11359 a0ee56 11323->11359 11326 a0ef6d 11330 a0ef79 ___scrt_is_nonwritable_in_current_image 11326->11330 11327 a0c7ad __dosmaperr 14 API calls 11335 a0efaa CallUnexpected 11327->11335 11328 a0efc9 11329 a0a4ef __strnicoll 14 API calls 11328->11329 11333 a0efce 11329->11333 11330->11327 11330->11328 11331 a0efdb CallUnexpected 11330->11331 11330->11335 11332 a0f011 CallUnexpected 11331->11332 11372 a0c988 RtlEnterCriticalSection 11331->11372 11340 a0f14b 11332->11340 11342 a0f04e 11332->11342 11350 a0f07c 11332->11350 11370 a08fd0 11333->11370 11335->11328 11335->11331 11337 a0efb3 11335->11337 11337->11159 11339 a0f156 11344 a09bc2 CallUnexpected 21 API calls 11339->11344 11340->11339 11404 a0c9d0 RtlLeaveCriticalSection 11340->11404 11342->11350 11373 a0c65c GetLastError 11342->11373 11345 a0f15e 11344->11345 11347 a0c65c _unexpected 41 API calls 11351 a0f0d1 11347->11351 11349 a0c65c _unexpected 41 API calls 11349->11350 11400 a0f0f7 11350->11400 11351->11337 11352 a0c65c _unexpected 41 API calls 11351->11352 11352->11337 11354 a08df0 CallUnexpected 11353->11354 11355 a08e1c IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 11354->11355 11358 a08eed CallUnexpected 11355->11358 11357 a08f0b 11357->11166 11427 a03646 11358->11427 11360 a0ee62 ___scrt_is_nonwritable_in_current_image 11359->11360 11365 a0c988 RtlEnterCriticalSection 11360->11365 11362 a0ee70 11366 a0eeb2 11362->11366 11365->11362 11369 a0c9d0 RtlLeaveCriticalSection 11366->11369 11368 a0a2ee 11368->11159 11368->11326 11369->11368 11405 a08f1c 11370->11405 11372->11332 11374 a0c672 11373->11374 11375 a0c678 11373->11375 11377 a0a88b _unexpected 6 API calls 11374->11377 11376 a0a8ca _unexpected 6 API calls 11375->11376 11379 a0c67c SetLastError 11375->11379 11378 a0c694 11376->11378 11377->11375 11378->11379 11381 a0a502 _unexpected 14 API calls 11378->11381 11383 a0c711 11379->11383 11384 a0c70c 11379->11384 11382 a0c6a9 11381->11382 11385 a0c6b1 11382->11385 11386 a0c6c2 11382->11386 11387 a0a2e9 CallUnexpected 39 API calls 11383->11387 11384->11349 11388 a0a8ca _unexpected 6 API calls 11385->11388 11389 a0a8ca _unexpected 6 API calls 11386->11389 11390 a0c716 11387->11390 11397 a0c6bf 11388->11397 11391 a0c6ce 11389->11391 11392 a0c6d2 11391->11392 11393 a0c6e9 11391->11393 11394 a0a8ca _unexpected 6 API calls 11392->11394 11396 a0c48a _unexpected 14 API calls 11393->11396 11394->11397 11395 a0a55f ___free_lconv_mon 14 API calls 11395->11379 11398 a0c6f4 11396->11398 11397->11395 11399 a0a55f ___free_lconv_mon 14 API calls 11398->11399 11399->11379 11401 a0f0c3 11400->11401 11402 a0f0fb 11400->11402 11401->11337 11401->11347 11401->11351 11426 a0c9d0 RtlLeaveCriticalSection 11402->11426 11404->11339 11406 a08f2e __strnicoll 11405->11406 11411 a08f53 11406->11411 11412 a08f63 11411->11412 11413 a08f6a 11411->11413 11414 a075a0 __strnicoll 16 API calls 11412->11414 11415 a08dab __strnicoll GetLastError SetLastError 11413->11415 11418 a08f46 11413->11418 11414->11413 11416 a08f9f 11415->11416 11417 a08ffd __strnicoll 11 API calls 11416->11417 11416->11418 11419 a08fcf 11417->11419 11420 a07390 11418->11420 11421 a0739c 11420->11421 11422 a073b3 11421->11422 11423 a075f0 __strnicoll 41 API calls 11421->11423 11424 a073c6 11422->11424 11425 a075f0 __strnicoll 41 API calls 11422->11425 11423->11422 11425->11424 11426->11401 11428 a0364e 11427->11428 11429 a0364f IsProcessorFeaturePresent 11427->11429 11428->11357 11431 a03943 11429->11431 11434 a03906 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 11431->11434 11433 a03a26 11433->11357 11434->11433 11436 a0d91d ___scrt_is_nonwritable_in_current_image 11435->11436 11437 a0d937 11436->11437 11479 a0c988 RtlEnterCriticalSection 11436->11479 11439 a0d7e6 11437->11439 11442 a0a2e9 CallUnexpected 41 API calls 11437->11442 11446 a0d543 11439->11446 11440 a0d973 11480 a0d990 11440->11480 11443 a0d9b0 11442->11443 11444 a0d947 11444->11440 11445 a0a55f ___free_lconv_mon 14 API calls 11444->11445 11445->11440 11484 a0d047 11446->11484 11449 a0d564 GetOEMCP 11452 a0d58d 11449->11452 11450 a0d576 11451 a0d57b GetACP 11450->11451 11450->11452 11451->11452 11452->11116 11453 a0afbc 11452->11453 11454 a0affa 11453->11454 11455 a0afca _unexpected 11453->11455 11457 a0a4ef __strnicoll 14 API calls 11454->11457 11455->11454 11456 a0afe5 RtlAllocateHeap 11455->11456 11459 a09066 _unexpected 2 API calls 11455->11459 11456->11455 11458 a0aff8 11456->11458 11457->11458 11458->11119 11458->11120 11459->11455 11461 a0d543 43 API calls 11460->11461 11462 a0da2c 11461->11462 11464 a0da69 IsValidCodePage 11462->11464 11468 a0db31 11462->11468 11470 a0da84 CallUnexpected 11462->11470 11463 a03646 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 11465 a0d853 11463->11465 11466 a0da7b 11464->11466 11464->11468 11465->11124 11465->11129 11467 a0daa4 GetCPInfo 11466->11467 11466->11470 11467->11468 11467->11470 11468->11463 11526 a0d617 11470->11526 11472 a0d441 ___scrt_is_nonwritable_in_current_image 11471->11472 11603 a0c988 RtlEnterCriticalSection 11472->11603 11474 a0d44b 11604 a0d482 11474->11604 11479->11444 11483 a0c9d0 RtlLeaveCriticalSection 11480->11483 11482 a0d997 11482->11437 11483->11482 11485 a0d065 11484->11485 11491 a0d05e 11484->11491 11486 a0c65c _unexpected 41 API calls 11485->11486 11485->11491 11487 a0d086 11486->11487 11492 a0b2dc 11487->11492 11491->11449 11491->11450 11493 a0b304 11492->11493 11494 a0b2ef 11492->11494 11496 a0b33a 11493->11496 11494->11493 11500 a0ec64 11494->11500 11497 a0b362 11496->11497 11498 a0b34d 11496->11498 11497->11491 11498->11497 11521 a0d9f9 11498->11521 11501 a0ec70 ___scrt_is_nonwritable_in_current_image 11500->11501 11502 a0c65c _unexpected 41 API calls 11501->11502 11503 a0ec79 11502->11503 11504 a0ecbf 11503->11504 11513 a0c988 RtlEnterCriticalSection 11503->11513 11504->11493 11506 a0ec97 11514 a0ece5 11506->11514 11511 a0a2e9 CallUnexpected 41 API calls 11512 a0ece4 11511->11512 11513->11506 11515 a0ecf3 _unexpected 11514->11515 11517 a0eca8 11514->11517 11516 a0ea18 _unexpected 14 API calls 11515->11516 11515->11517 11516->11517 11518 a0ecc4 11517->11518 11519 a0c9d0 CallUnexpected RtlLeaveCriticalSection 11518->11519 11520 a0ecbb 11519->11520 11520->11504 11520->11511 11522 a0c65c _unexpected 41 API calls 11521->11522 11523 a0d9fe 11522->11523 11524 a0d911 __strnicoll 41 API calls 11523->11524 11525 a0da09 11524->11525 11525->11497 11527 a0d63f GetCPInfo 11526->11527 11536 a0d708 11526->11536 11532 a0d657 11527->11532 11527->11536 11529 a03646 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 11531 a0d7ba 11529->11531 11531->11468 11537 a0e87a 11532->11537 11535 a12df3 45 API calls 11535->11536 11536->11529 11538 a0d047 __strnicoll 41 API calls 11537->11538 11539 a0e89a 11538->11539 11557 a0dd92 11539->11557 11541 a0e956 11543 a03646 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 11541->11543 11542 a0e94e 11560 a0e97b 11542->11560 11546 a0d6bf 11543->11546 11544 a0e8c7 11544->11541 11544->11542 11545 a0afbc __strnicoll 15 API calls 11544->11545 11548 a0e8ec CallUnexpected __alloca_probe_16 11544->11548 11545->11548 11552 a12df3 11546->11552 11548->11542 11549 a0dd92 __strnicoll MultiByteToWideChar 11548->11549 11550 a0e935 11549->11550 11550->11542 11551 a0e93c GetStringTypeW 11550->11551 11551->11542 11553 a0d047 __strnicoll 41 API calls 11552->11553 11554 a12e06 11553->11554 11566 a12c04 11554->11566 11564 a0dcfa 11557->11564 11561 a0e987 11560->11561 11562 a0e998 11560->11562 11561->11562 11563 a0a55f ___free_lconv_mon 14 API calls 11561->11563 11562->11541 11563->11562 11565 a0dd0b MultiByteToWideChar 11564->11565 11565->11544 11567 a12c1f __strnicoll 11566->11567 11568 a0dd92 __strnicoll MultiByteToWideChar 11567->11568 11572 a12c63 11568->11572 11569 a12dde 11570 a03646 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 11569->11570 11571 a0d6e0 11570->11571 11571->11535 11572->11569 11573 a0afbc __strnicoll 15 API calls 11572->11573 11575 a12c89 __alloca_probe_16 11572->11575 11586 a12d31 11572->11586 11573->11575 11574 a0e97b __freea 14 API calls 11574->11569 11576 a0dd92 __strnicoll MultiByteToWideChar 11575->11576 11575->11586 11577 a12cd2 11576->11577 11577->11586 11594 a0a957 11577->11594 11580 a12d40 11582 a12dc9 11580->11582 11583 a0afbc __strnicoll 15 API calls 11580->11583 11587 a12d52 __alloca_probe_16 11580->11587 11581 a12d08 11585 a0a957 6 API calls 11581->11585 11581->11586 11584 a0e97b __freea 14 API calls 11582->11584 11583->11587 11584->11586 11585->11586 11586->11574 11587->11582 11588 a0a957 6 API calls 11587->11588 11589 a12d95 11588->11589 11589->11582 11600 a0de4c 11589->11600 11591 a12daf 11591->11582 11592 a12db8 11591->11592 11593 a0e97b __freea 14 API calls 11592->11593 11593->11586 11595 a0a5cd LoadLibraryExW GetLastError LoadLibraryExW FreeLibrary GetProcAddress 11594->11595 11596 a0a962 11595->11596 11597 a0a9b4 __strnicoll 5 API calls 11596->11597 11599 a0a968 11596->11599 11598 a0a9a8 LCMapStringW 11597->11598 11598->11599 11599->11580 11599->11581 11599->11586 11601 a0de5f ___scrt_uninitialize_crt 11600->11601 11602 a0de9d WideCharToMultiByte 11601->11602 11602->11591 11603->11474 11614 a0dc11 11604->11614 11606 a0d4a4 11607 a0dc11 41 API calls 11606->11607 11608 a0d4c3 11607->11608 11609 a0a55f ___free_lconv_mon 14 API calls 11608->11609 11610 a0d458 11608->11610 11609->11610 11611 a0d476 11610->11611 11628 a0c9d0 RtlLeaveCriticalSection 11611->11628 11613 a0d464 11613->11130 11615 a0dc22 11614->11615 11618 a0dc1e __InternalCxxFrameHandler 11614->11618 11616 a0dc29 11615->11616 11620 a0dc3c CallUnexpected 11615->11620 11617 a0a4ef __strnicoll 14 API calls 11616->11617 11619 a0dc2e 11617->11619 11618->11606 11621 a08fd0 __strnicoll 41 API calls 11619->11621 11620->11618 11622 a0dc73 11620->11622 11623 a0dc6a 11620->11623 11621->11618 11622->11618 11626 a0a4ef __strnicoll 14 API calls 11622->11626 11624 a0a4ef __strnicoll 14 API calls 11623->11624 11625 a0dc6f 11624->11625 11627 a08fd0 __strnicoll 41 API calls 11625->11627 11626->11625 11627->11618 11628->11613 11630 a0a33b 11629->11630 11631 a0a349 11629->11631 11630->11631 11636 a0a361 11630->11636 11632 a0a4ef __strnicoll 14 API calls 11631->11632 11633 a0a351 11632->11633 11635 a08fd0 __strnicoll 41 API calls 11633->11635 11634 a0a35b 11634->11077 11635->11634 11636->11634 11637 a0a4ef __strnicoll 14 API calls 11636->11637 11637->11633 11639 a0975a 11638->11639 11643 a0972b 11638->11643 11640 a09771 11639->11640 11641 a0a55f ___free_lconv_mon 14 API calls 11639->11641 11642 a0a55f ___free_lconv_mon 14 API calls 11640->11642 11641->11639 11642->11643 11643->11078 11645 a09009 11644->11645 11646 a08dd4 CallUnexpected 8 API calls 11645->11646 11647 a0901e GetCurrentProcess TerminateProcess 11646->11647 11647->11084 11649 a03010 11648->11649 11649->11649 11650 a03025 11649->11650 11651 a030d6 11649->11651 11653 a03031 __InternalCxxFrameHandler 11650->11653 11654 a03057 11650->11654 11657 a03092 11650->11657 11658 a0309b 11650->11658 11702 a011d0 11651->11702 11653->10883 11689 a03654 11654->11689 11655 a030db 11709 a01130 11655->11709 11657->11654 11657->11655 11662 a03654 42 API calls 11658->11662 11664 a03073 __InternalCxxFrameHandler 11658->11664 11660 a0306a 11661 a08fe0 41 API calls 11660->11661 11660->11664 11663 a030e5 11661->11663 11662->11664 11664->10883 11666 a0101e 11665->11666 11738 a08cc6 11666->11738 11670 a0323b 11669->11670 11671 a0311b 11669->11671 11672 a011d0 47 API calls 11670->11672 11674 a03189 11671->11674 11675 a0317c 11671->11675 11677 a03130 11671->11677 11673 a03240 11672->11673 11676 a01130 Concurrency::cancel_current_task 42 API calls 11673->11676 11679 a03654 42 API calls 11674->11679 11682 a03140 __InternalCxxFrameHandler 11674->11682 11675->11673 11675->11677 11676->11682 11678 a03654 42 API calls 11677->11678 11678->11682 11679->11682 11680 a08fe0 41 API calls 11681 a0324a 11680->11681 11682->11680 11683 a031f9 __InternalCxxFrameHandler 11682->11683 11683->10870 11685 a08f1c __strnicoll 41 API calls 11684->11685 11686 a08fef 11685->11686 11687 a08ffd __strnicoll 11 API calls 11686->11687 11688 a08ffc 11687->11688 11691 a03659 ___std_exception_copy 11689->11691 11690 a03673 11690->11660 11691->11690 11692 a09066 _unexpected 2 API calls 11691->11692 11693 a03675 11691->11693 11692->11691 11694 a01130 Concurrency::cancel_current_task 11693->11694 11696 a0367f 11693->11696 11715 a0480b 11694->11715 11698 a0480b CallUnexpected RaiseException 11696->11698 11697 a0114c 11718 a045cb 11697->11718 11699 a03a44 11698->11699 11727 a03626 11702->11727 11710 a0113e Concurrency::cancel_current_task 11709->11710 11711 a0480b CallUnexpected RaiseException 11710->11711 11712 a0114c 11711->11712 11713 a045cb ___std_exception_copy 41 API calls 11712->11713 11714 a01173 11713->11714 11714->11660 11716 a04852 RaiseException 11715->11716 11717 a04825 11715->11717 11716->11697 11717->11716 11719 a045d8 ___std_exception_copy 11718->11719 11723 a01173 11718->11723 11720 a04605 11719->11720 11721 a0a32d ___std_exception_copy 41 API calls 11719->11721 11719->11723 11724 a09db4 11720->11724 11721->11720 11723->11660 11725 a0a55f ___free_lconv_mon 14 API calls 11724->11725 11726 a09dcc 11725->11726 11726->11723 11732 a035bf 11727->11732 11730 a0480b CallUnexpected RaiseException 11731 a03645 11730->11731 11735 a0356f 11732->11735 11736 a045cb ___std_exception_copy 41 API calls 11735->11736 11737 a0359b 11736->11737 11737->11730 11739 a08cda __strnicoll 11738->11739 11740 a08cfc 11739->11740 11741 a08d23 11739->11741 11742 a08f53 __strnicoll 29 API calls 11740->11742 11747 a0660c 11741->11747 11743 a08d17 11742->11743 11745 a07390 __strnicoll 41 API calls 11743->11745 11746 a01038 11745->11746 11746->10873 11748 a06618 ___scrt_is_nonwritable_in_current_image 11747->11748 11755 a065e4 RtlEnterCriticalSection 11748->11755 11750 a06626 11756 a0740a 11750->11756 11755->11750 11770 a0c235 11756->11770 11758 a07431 11777 a076c4 11758->11777 11765 a03646 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 11766 a06633 11765->11766 11767 a0665b 11766->11767 12200 a065f8 RtlLeaveCriticalSection 11767->12200 11769 a06644 11769->11743 11799 a0c1f7 11770->11799 11772 a0c2a8 11772->11758 11773 a0c246 11773->11772 11774 a0afbc __strnicoll 15 API calls 11773->11774 11775 a0c29f 11774->11775 11776 a0a55f ___free_lconv_mon 14 API calls 11775->11776 11776->11772 11822 a08a46 11777->11822 11780 a076ea 11781 a08f53 __strnicoll 29 API calls 11780->11781 11782 a07478 11781->11782 11792 a073cc 11782->11792 11786 a07712 11786->11782 11788 a07906 11786->11788 11828 a089d0 11786->11828 11835 a0764c 11786->11835 11838 a07c48 11786->11838 11872 a07efa 11786->11872 11789 a08f53 __strnicoll 29 API calls 11788->11789 11790 a07920 11789->11790 11791 a08f53 __strnicoll 29 API calls 11790->11791 11791->11782 11793 a0a55f ___free_lconv_mon 14 API calls 11792->11793 11794 a073dc 11793->11794 11795 a0c2e0 11794->11795 11796 a0c2eb 11795->11796 11797 a07492 11795->11797 11796->11797 12102 a0acb3 11796->12102 11797->11765 11800 a0c203 11799->11800 11801 a0c22d 11800->11801 11806 a0c18e 11800->11806 11801->11773 11803 a0c21e 11813 a1250f 11803->11813 11805 a0c224 11805->11773 11807 a0c19a 11806->11807 11808 a0c1af 11806->11808 11809 a0a4ef __strnicoll 14 API calls 11807->11809 11808->11803 11810 a0c19f 11809->11810 11811 a08fd0 __strnicoll 41 API calls 11810->11811 11812 a0c1aa 11811->11812 11812->11803 11814 a1251c 11813->11814 11816 a12529 11813->11816 11815 a0a4ef __strnicoll 14 API calls 11814->11815 11817 a12521 11815->11817 11818 a12535 11816->11818 11819 a0a4ef __strnicoll 14 API calls 11816->11819 11817->11805 11818->11805 11820 a12556 11819->11820 11821 a08fd0 __strnicoll 41 API calls 11820->11821 11821->11817 11823 a08a51 11822->11823 11824 a08a73 11822->11824 11825 a08f53 __strnicoll 29 API calls 11823->11825 11901 a08aaf 11824->11901 11827 a076df 11825->11827 11827->11780 11827->11782 11827->11786 11909 a075f0 11828->11909 11948 a068d9 11835->11948 11837 a07687 11837->11786 11839 a07c66 11838->11839 11840 a07c4f 11838->11840 11841 a08f53 __strnicoll 29 API calls 11839->11841 11853 a07ca5 11839->11853 11842 a07f8a 11840->11842 11843 a07f1e 11840->11843 11840->11853 11846 a07c9a 11841->11846 11844 a07fc9 11842->11844 11845 a07f8f 11842->11845 11847 a07fb2 11843->11847 11848 a07f24 11843->11848 11849 a07fe8 11844->11849 11850 a07fce 11844->11850 11851 a07fc0 11845->11851 11852 a07f91 11845->11852 11846->11786 11996 a06c93 11847->11996 11857 a07f29 11848->11857 11859 a07f7f 11848->11859 12007 a0891a 11849->12007 11850->11847 11850->11859 11871 a07f51 11850->11871 12003 a088fd 11851->12003 11862 a07fa0 11852->11862 11863 a07f38 11852->11863 11853->11786 11860 a07f64 11857->11860 11857->11863 11857->11871 11870 a07ff3 11859->11870 11985 a06e20 11859->11985 11860->11870 11981 a087e3 11860->11981 11862->11847 11865 a07fa4 11862->11865 11863->11870 11971 a08652 11863->11971 11865->11870 11992 a08878 11865->11992 11866 a03646 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 11867 a0823a 11866->11867 11867->11786 11870->11866 11871->11870 12010 a0bef1 11871->12010 11873 a07f8a 11872->11873 11874 a07f1e 11872->11874 11875 a07fc9 11873->11875 11876 a07f8f 11873->11876 11877 a07fb2 11874->11877 11878 a07f24 11874->11878 11879 a07fe8 11875->11879 11880 a07fce 11875->11880 11881 a07fc0 11876->11881 11882 a07f91 11876->11882 11885 a06c93 30 API calls 11877->11885 11887 a07f7f 11878->11887 11888 a07f29 11878->11888 11884 a0891a 30 API calls 11879->11884 11880->11877 11880->11887 11900 a07f51 11880->11900 11886 a088fd 30 API calls 11881->11886 11883 a07f38 11882->11883 11890 a07fa0 11882->11890 11889 a08652 44 API calls 11883->11889 11899 a07ff3 11883->11899 11884->11900 11885->11900 11886->11900 11892 a06e20 30 API calls 11887->11892 11887->11899 11888->11883 11891 a07f64 11888->11891 11888->11900 11889->11900 11890->11877 11893 a07fa4 11890->11893 11894 a087e3 43 API calls 11891->11894 11891->11899 11892->11900 11897 a08878 29 API calls 11893->11897 11893->11899 11894->11900 11895 a03646 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 11896 a0823a 11895->11896 11896->11786 11897->11900 11898 a0bef1 43 API calls 11898->11900 11899->11895 11900->11898 11900->11899 11902 a08b2d 11901->11902 11903 a08ac3 11901->11903 11902->11827 11904 a0c18e ___scrt_uninitialize_crt 41 API calls 11903->11904 11905 a08aca 11904->11905 11905->11902 11906 a0a4ef __strnicoll 14 API calls 11905->11906 11907 a08b22 11906->11907 11908 a08fd0 __strnicoll 41 API calls 11907->11908 11908->11902 11910 a075fe GetLastError 11909->11910 11911 a0763f 11909->11911 11912 a0760d 11910->11912 11918 a0b309 11911->11918 11926 a0c85e 11912->11926 11915 a07646 11916 a0a2e9 CallUnexpected 39 API calls 11915->11916 11917 a0764b 11916->11917 11919 a0b320 11918->11919 11920 a089fd 11918->11920 11919->11920 11921 a0ec64 __strnicoll 41 API calls 11919->11921 11922 a0b367 11920->11922 11921->11920 11923 a08a0a 11922->11923 11924 a0b37e 11922->11924 11923->11786 11924->11923 11925 a0d9f9 __strnicoll 41 API calls 11924->11925 11925->11923 11927 a0c871 11926->11927 11932 a0c877 11926->11932 11929 a0a88b _unexpected 6 API calls 11927->11929 11928 a0a8ca _unexpected 6 API calls 11930 a0c891 11928->11930 11929->11932 11931 a0762a SetLastError 11930->11931 11933 a0a502 _unexpected 14 API calls 11930->11933 11931->11911 11931->11915 11932->11928 11932->11931 11934 a0c8a1 11933->11934 11935 a0c8a9 11934->11935 11936 a0c8be 11934->11936 11937 a0a8ca _unexpected 6 API calls 11935->11937 11938 a0a8ca _unexpected 6 API calls 11936->11938 11939 a0c8b5 11937->11939 11940 a0c8ca 11938->11940 11944 a0a55f ___free_lconv_mon 14 API calls 11939->11944 11941 a0c8dd 11940->11941 11942 a0c8ce 11940->11942 11943 a0c48a _unexpected 14 API calls 11941->11943 11945 a0a8ca _unexpected 6 API calls 11942->11945 11946 a0c8e8 11943->11946 11944->11931 11945->11939 11947 a0a55f ___free_lconv_mon 14 API calls 11946->11947 11947->11931 11958 a08a2b 11948->11958 11950 a068eb 11951 a06900 11950->11951 11953 a06933 11950->11953 11957 a0691b 11950->11957 11952 a08f53 __strnicoll 29 API calls 11951->11952 11952->11957 11954 a069ca 11953->11954 11965 a089a2 11953->11965 11955 a089a2 41 API calls 11954->11955 11955->11957 11957->11837 11959 a08a30 11958->11959 11960 a08a43 11958->11960 11961 a0a4ef __strnicoll 14 API calls 11959->11961 11960->11950 11962 a08a35 11961->11962 11963 a08fd0 __strnicoll 41 API calls 11962->11963 11964 a08a40 11963->11964 11964->11950 11966 a089b3 11965->11966 11967 a089c7 11965->11967 11966->11967 11968 a0a4ef __strnicoll 14 API calls 11966->11968 11967->11954 11969 a089bc 11968->11969 11970 a08fd0 __strnicoll 41 API calls 11969->11970 11970->11967 11972 a0866c 11971->11972 12020 a067f3 11972->12020 11974 a086ab 12031 a0bd70 11974->12031 11977 a089d0 ___scrt_uninitialize_crt 41 API calls 11978 a08762 11977->11978 11979 a089d0 ___scrt_uninitialize_crt 41 API calls 11978->11979 11980 a08795 11978->11980 11979->11980 11980->11871 11980->11980 11983 a087fe 11981->11983 11982 a08834 11982->11871 11983->11982 11984 a0bef1 43 API calls 11983->11984 11984->11982 11986 a06e35 11985->11986 11987 a06e57 11986->11987 11989 a06e7e 11986->11989 11988 a08f53 __strnicoll 29 API calls 11987->11988 11991 a06e74 11988->11991 11990 a067f3 15 API calls 11989->11990 11989->11991 11990->11991 11991->11871 11995 a0888e 11992->11995 11993 a08f53 __strnicoll 29 API calls 11994 a088af 11993->11994 11994->11871 11995->11993 11995->11994 11997 a06ca8 11996->11997 11998 a06cca 11997->11998 12000 a06cf1 11997->12000 11999 a08f53 __strnicoll 29 API calls 11998->11999 12002 a06ce7 11999->12002 12001 a067f3 15 API calls 12000->12001 12000->12002 12001->12002 12002->11871 12004 a08909 12003->12004 12095 a06b06 12004->12095 12006 a08919 12006->11871 12008 a06e20 30 API calls 12007->12008 12009 a0892f 12008->12009 12009->11871 12011 a0bf06 12010->12011 12012 a0bf47 12011->12012 12014 a089d0 ___scrt_uninitialize_crt 41 API calls 12011->12014 12015 a0bf33 CallUnexpected 12011->12015 12019 a0bf0a CallUnexpected 12011->12019 12012->12015 12016 a0de4c ___scrt_uninitialize_crt WideCharToMultiByte 12012->12016 12012->12019 12013 a08f53 __strnicoll 29 API calls 12013->12019 12014->12012 12015->12013 12015->12019 12017 a0c002 12016->12017 12018 a0c018 GetLastError 12017->12018 12017->12019 12018->12015 12018->12019 12019->11871 12021 a0681a 12020->12021 12022 a06808 12020->12022 12021->12022 12023 a0afbc __strnicoll 15 API calls 12021->12023 12022->11974 12024 a0683e 12023->12024 12025 a06851 12024->12025 12026 a06846 12024->12026 12050 a073e6 12025->12050 12027 a0a55f ___free_lconv_mon 14 API calls 12026->12027 12027->12022 12030 a0a55f ___free_lconv_mon 14 API calls 12030->12022 12032 a0bda5 12031->12032 12034 a0bd81 12031->12034 12032->12034 12035 a0bdd8 12032->12035 12033 a08f53 __strnicoll 29 API calls 12045 a0873e 12033->12045 12034->12033 12036 a0be11 12035->12036 12038 a0be40 12035->12038 12053 a0bc14 12036->12053 12037 a0be69 12042 a0bed0 12037->12042 12043 a0be96 12037->12043 12038->12037 12039 a0be6e 12038->12039 12061 a0b49d 12039->12061 12088 a0b7ca 12042->12088 12046 a0beb6 12043->12046 12047 a0be9b 12043->12047 12045->11977 12045->11978 12081 a0b9c1 12046->12081 12071 a0bb45 12047->12071 12051 a0a55f ___free_lconv_mon 14 API calls 12050->12051 12052 a0685c 12051->12052 12052->12030 12054 a0bc2a 12053->12054 12055 a0bc35 12053->12055 12054->12045 12056 a0a32d ___std_exception_copy 41 API calls 12055->12056 12058 a0bc90 12056->12058 12057 a0bc9a 12057->12045 12058->12057 12059 a08ffd __strnicoll 11 API calls 12058->12059 12060 a0bca8 12059->12060 12062 a0b4b0 12061->12062 12063 a0b4e1 12062->12063 12064 a0b4bf 12062->12064 12066 a0b4f6 12063->12066 12068 a0b549 12063->12068 12065 a08f53 __strnicoll 29 API calls 12064->12065 12070 a0b4d7 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z CallUnexpected __allrem _strrchr 12065->12070 12067 a0b7ca 43 API calls 12066->12067 12067->12070 12069 a089d0 ___scrt_uninitialize_crt 41 API calls 12068->12069 12068->12070 12069->12070 12070->12045 12072 a10a9b 43 API calls 12071->12072 12073 a0bb75 12072->12073 12074 a104f3 29 API calls 12073->12074 12075 a0bbb3 12074->12075 12076 a0bbba 12075->12076 12077 a0bbf3 12075->12077 12079 a0bbcc 12075->12079 12076->12045 12078 a0b86e 41 API calls 12077->12078 12078->12076 12080 a0ba57 41 API calls 12079->12080 12080->12076 12082 a10a9b 43 API calls 12081->12082 12083 a0b9f0 12082->12083 12084 a104f3 29 API calls 12083->12084 12085 a0ba31 12084->12085 12086 a0ba38 12085->12086 12087 a0ba57 41 API calls 12085->12087 12086->12045 12087->12086 12089 a10a9b 43 API calls 12088->12089 12090 a0b7f4 12089->12090 12091 a104f3 29 API calls 12090->12091 12092 a0b842 12091->12092 12093 a0b849 12092->12093 12094 a0b86e 41 API calls 12092->12094 12093->12045 12094->12093 12096 a06b1b 12095->12096 12097 a06b3d 12096->12097 12099 a06b64 12096->12099 12098 a08f53 __strnicoll 29 API calls 12097->12098 12101 a06b5a 12098->12101 12100 a067f3 15 API calls 12099->12100 12099->12101 12100->12101 12101->12006 12103 a0accc 12102->12103 12107 a0acf3 12102->12107 12104 a0c18e ___scrt_uninitialize_crt 41 API calls 12103->12104 12103->12107 12105 a0ace8 12104->12105 12108 a10115 12105->12108 12107->11797 12110 a10121 ___scrt_is_nonwritable_in_current_image 12108->12110 12109 a10162 12111 a08f53 __strnicoll 29 API calls 12109->12111 12110->12109 12112 a101a8 12110->12112 12118 a10129 12110->12118 12111->12118 12119 a0e4b3 RtlEnterCriticalSection 12112->12119 12114 a101ae 12115 a101cc 12114->12115 12120 a10226 12114->12120 12146 a1021e 12115->12146 12118->12107 12119->12114 12121 a1024e 12120->12121 12125 a10271 ___scrt_uninitialize_crt 12120->12125 12122 a10252 12121->12122 12124 a102ad 12121->12124 12123 a08f53 __strnicoll 29 API calls 12122->12123 12123->12125 12126 a102cb 12124->12126 12149 a135d7 12124->12149 12125->12115 12152 a0fda2 12126->12152 12130 a102e3 12134 a10312 12130->12134 12135 a102eb 12130->12135 12131 a1032a 12132 a10393 WriteFile 12131->12132 12133 a1033e 12131->12133 12132->12125 12136 a103b5 GetLastError 12132->12136 12138 a10346 12133->12138 12139 a1037f 12133->12139 12164 a0f973 GetConsoleOutputCP 12134->12164 12135->12125 12159 a0fd3a 12135->12159 12136->12125 12140 a1036b 12138->12140 12143 a1034b 12138->12143 12192 a0fe1f 12139->12192 12184 a0ffe3 12140->12184 12143->12125 12177 a0fefa 12143->12177 12199 a0e4d6 RtlLeaveCriticalSection 12146->12199 12148 a10224 12148->12118 12150 a13514 ___scrt_uninitialize_crt 43 API calls 12149->12150 12151 a135f0 12150->12151 12151->12126 12153 a1250f ___scrt_uninitialize_crt 41 API calls 12152->12153 12155 a0fdb4 12153->12155 12154 a0fe18 12154->12130 12154->12131 12155->12154 12156 a089d0 ___scrt_uninitialize_crt 41 API calls 12155->12156 12158 a0fde2 12155->12158 12156->12158 12157 a0fdfc GetConsoleMode 12157->12154 12158->12154 12158->12157 12162 a0fd5c 12159->12162 12163 a0fd91 12159->12163 12160 a135f5 5 API calls ___scrt_uninitialize_crt 12160->12162 12161 a0fd93 GetLastError 12161->12163 12162->12160 12162->12161 12162->12163 12163->12125 12165 a0f9e5 12164->12165 12172 a0f9ec __InternalCxxFrameHandler 12164->12172 12166 a089d0 ___scrt_uninitialize_crt 41 API calls 12165->12166 12166->12172 12167 a03646 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 12168 a0fd33 12167->12168 12168->12125 12169 a0c05b 42 API calls ___scrt_uninitialize_crt 12169->12172 12170 a0fca2 12170->12167 12171 a0de4c ___scrt_uninitialize_crt WideCharToMultiByte 12171->12172 12172->12169 12172->12170 12172->12171 12172->12172 12173 a0fc1b WriteFile 12172->12173 12175 a121af 5 API calls ___scrt_uninitialize_crt 12172->12175 12176 a0fc59 WriteFile 12172->12176 12173->12172 12174 a0fd11 GetLastError 12173->12174 12174->12170 12175->12172 12176->12172 12176->12174 12182 a0ff09 ___scrt_uninitialize_crt 12177->12182 12178 a0ffc8 12179 a03646 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 12178->12179 12181 a0ffe1 12179->12181 12180 a0ff7e WriteFile 12180->12182 12183 a0ffca GetLastError 12180->12183 12181->12125 12182->12178 12182->12180 12183->12178 12191 a0fff2 ___scrt_uninitialize_crt 12184->12191 12185 a100fa 12186 a03646 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 12185->12186 12187 a10113 12186->12187 12187->12125 12188 a0de4c ___scrt_uninitialize_crt WideCharToMultiByte 12188->12191 12189 a100fc GetLastError 12189->12185 12190 a100b1 WriteFile 12190->12189 12190->12191 12191->12185 12191->12188 12191->12189 12191->12190 12197 a0fe2e ___scrt_uninitialize_crt 12192->12197 12193 a0fedf 12194 a03646 __ehhandler$?ConvertBSTRToString@_com_util@@YGPADPAG@Z 5 API calls 12193->12194 12195 a0fef8 12194->12195 12195->12125 12196 a0fe9e WriteFile 12196->12197 12198 a0fee1 GetLastError 12196->12198 12197->12193 12197->12196 12198->12193 12199->12148 12200->11769 12202 a09a71 12201->12202 12203 a09a5f 12201->12203 12213 a098fd 12202->12213 12204 a03ece CallUnexpected GetModuleHandleW 12203->12204 12206 a09a64 12204->12206 12206->12202 12228 a09b13 GetModuleHandleExW 12206->12228 12208 a09aae 12208->10818 12212 a09ac3 12214 a09909 ___scrt_is_nonwritable_in_current_image 12213->12214 12234 a0c988 RtlEnterCriticalSection 12214->12234 12216 a09913 12235 a0994a 12216->12235 12218 a09920 12239 a0993e 12218->12239 12221 a09ac9 12264 a09afa 12221->12264 12223 a09ad3 12224 a09ae7 12223->12224 12225 a09ad7 GetCurrentProcess TerminateProcess 12223->12225 12226 a09b13 CallUnexpected 3 API calls 12224->12226 12225->12224 12227 a09aef ExitProcess 12226->12227 12229 a09b52 GetProcAddress 12228->12229 12230 a09b73 12228->12230 12229->12230 12233 a09b66 12229->12233 12231 a09a70 12230->12231 12232 a09b79 FreeLibrary 12230->12232 12231->12202 12232->12231 12233->12230 12234->12216 12237 a09956 ___scrt_is_nonwritable_in_current_image CallUnexpected 12235->12237 12236 a099ba CallUnexpected 12236->12218 12237->12236 12242 a0a077 12237->12242 12263 a0c9d0 RtlLeaveCriticalSection 12239->12263 12241 a0992c 12241->12208 12241->12221 12243 a0a083 __EH_prolog3 12242->12243 12246 a09dcf 12243->12246 12245 a0a0aa CallUnexpected 12245->12236 12247 a09ddb ___scrt_is_nonwritable_in_current_image 12246->12247 12254 a0c988 RtlEnterCriticalSection 12247->12254 12249 a09de9 12255 a09f87 12249->12255 12254->12249 12256 a09df6 12255->12256 12258 a09fa6 12255->12258 12259 a09e1e 12256->12259 12257 a0a55f ___free_lconv_mon 14 API calls 12257->12256 12258->12256 12258->12257 12262 a0c9d0 RtlLeaveCriticalSection 12259->12262 12261 a09e07 12261->12245 12262->12261 12263->12241 12267 a0e33e 12264->12267 12266 a09aff CallUnexpected 12266->12223 12268 a0e34d CallUnexpected 12267->12268 12269 a0e35a 12268->12269 12271 a0a751 12268->12271 12269->12266 12272 a0a6cc _unexpected 5 API calls 12271->12272 12273 a0a76d 12272->12273 12273->12269 12275 a0a23b ___scrt_uninitialize_crt 12274->12275 12276 a0a229 12274->12276 12275->10904 12277 a0a237 12276->12277 12279 a0ad81 12276->12279 12277->10904 12282 a0ac12 12279->12282 12285 a0ab66 12282->12285 12286 a0ab72 ___scrt_is_nonwritable_in_current_image 12285->12286 12293 a0c988 RtlEnterCriticalSection 12286->12293 12288 a0abe8 12302 a0ac06 12288->12302 12291 a0ab7c ___scrt_uninitialize_crt 12291->12288 12294 a0aada 12291->12294 12293->12291 12295 a0aae6 ___scrt_is_nonwritable_in_current_image 12294->12295 12305 a065e4 RtlEnterCriticalSection 12295->12305 12297 a0aaf0 ___scrt_uninitialize_crt 12301 a0ab29 12297->12301 12306 a0ad1c 12297->12306 12319 a0ab5a 12301->12319 12367 a0c9d0 RtlLeaveCriticalSection 12302->12367 12304 a0abf4 12304->12277 12305->12297 12307 a0ad31 __strnicoll 12306->12307 12308 a0ad43 12307->12308 12309 a0ad38 12307->12309 12311 a0acb3 ___scrt_uninitialize_crt 66 API calls 12308->12311 12310 a0ac12 ___scrt_uninitialize_crt 70 API calls 12309->12310 12312 a0ad3e 12310->12312 12313 a0ad4d 12311->12313 12314 a07390 __strnicoll 41 API calls 12312->12314 12313->12312 12315 a0c18e ___scrt_uninitialize_crt 41 API calls 12313->12315 12316 a0ad7b 12314->12316 12317 a0ad64 12315->12317 12316->12301 12322 a0f8f6 12317->12322 12366 a065f8 RtlLeaveCriticalSection 12319->12366 12321 a0ab48 12321->12291 12323 a0f914 12322->12323 12324 a0f907 12322->12324 12325 a0f95d 12323->12325 12328 a0f93b 12323->12328 12326 a0a4ef __strnicoll 14 API calls 12324->12326 12327 a0a4ef __strnicoll 14 API calls 12325->12327 12332 a0f90c 12326->12332 12329 a0f962 12327->12329 12333 a0f854 12328->12333 12331 a08fd0 __strnicoll 41 API calls 12329->12331 12331->12332 12332->12312 12334 a0f860 ___scrt_is_nonwritable_in_current_image 12333->12334 12346 a0e4b3 RtlEnterCriticalSection 12334->12346 12336 a0f86f 12337 a0f8b4 12336->12337 12347 a0e58a 12336->12347 12338 a0a4ef __strnicoll 14 API calls 12337->12338 12340 a0f8bb 12338->12340 12363 a0f8ea 12340->12363 12341 a0f89b FlushFileBuffers 12341->12340 12342 a0f8a7 GetLastError 12341->12342 12360 a0a4dc 12342->12360 12346->12336 12348 a0e597 12347->12348 12349 a0e5ac 12347->12349 12350 a0a4dc __dosmaperr 14 API calls 12348->12350 12352 a0a4dc __dosmaperr 14 API calls 12349->12352 12354 a0e5d1 12349->12354 12351 a0e59c 12350->12351 12353 a0a4ef __strnicoll 14 API calls 12351->12353 12355 a0e5dc 12352->12355 12358 a0e5a4 12353->12358 12354->12341 12356 a0a4ef __strnicoll 14 API calls 12355->12356 12357 a0e5e4 12356->12357 12359 a08fd0 __strnicoll 41 API calls 12357->12359 12358->12341 12359->12358 12361 a0c7ad __dosmaperr 14 API calls 12360->12361 12362 a0a4e1 12361->12362 12362->12337 12364 a0e4d6 ___scrt_uninitialize_crt RtlLeaveCriticalSection 12363->12364 12365 a0f8d3 12364->12365 12365->12332 12366->12321 12367->12304 12368->10917

                                                                                                                                                  Executed Functions

                                                                                                                                                  Function 00A01260 Relevance: 25.9, APIs: 1, Strings: 15, Instructions: 1921COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • CoInitialize.OLE32(00000000), ref: 00A012AD
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000007.00000002.2414728783.0000000000A01000.00000040.00000001.01000000.00000021.sdmp, Offset: 00A00000, based on PE: true
                                                                                                                                                  • Associated: 00000007.00000002.2414712056.0000000000A00000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A1F000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A24000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414797468.0000000000A25000.00000080.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414816674.0000000000A27000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_7_2_a00000_netconn_properties.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Initialize
                                                                                                                                                  • String ID: "MediaType": "$"Status": "$"clsidThisObject": "$"clsidUiObject": "$"dwCharacter": "$"guidId": "$"pszwDeviceName": "$"pszwName": "${$",$%$Error getting connection properties: 0x%x"}${"error": "Error creating INetConnectionManager object: 0x%x"}${"error": "Error enumerating network connections: 0x%x"}${"error": "Error initializing COM: 0x%x"}
                                                                                                                                                  • API String ID: 2538663250-3156161455
                                                                                                                                                  • Opcode ID: 711d0258e6963f1ef638e975516a28e0e2dfa988d51b8ca663cc07d97a881ade
                                                                                                                                                  • Instruction ID: cfa90c3f1d48741f55d9c0efe8e7c7bc6a90ce62b737e3cddf45d8ecd73dc616
                                                                                                                                                  • Opcode Fuzzy Hash: 711d0258e6963f1ef638e975516a28e0e2dfa988d51b8ca663cc07d97a881ade
                                                                                                                                                  • Instruction Fuzzy Hash: 4203D231A002588FEB29CB28DD99BDDBBB1AF55304F1482D8E449AB2D2DB745FC4CB51
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00A09AC9 Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  APIs
                                                                                                                                                  • GetCurrentProcess.KERNEL32(00A09BD3,?,00A09AC3,00000000,?,?,00A09BD3,2EC2FEAC,?,00A09BD3), ref: 00A09ADA
                                                                                                                                                  • TerminateProcess.KERNEL32(00000000,?,00A09AC3,00000000,?,?,00A09BD3,2EC2FEAC,?,00A09BD3), ref: 00A09AE1
                                                                                                                                                  • ExitProcess.KERNEL32 ref: 00A09AF3
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000007.00000002.2414728783.0000000000A01000.00000040.00000001.01000000.00000021.sdmp, Offset: 00A00000, based on PE: true
                                                                                                                                                  • Associated: 00000007.00000002.2414712056.0000000000A00000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A1F000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A24000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414797468.0000000000A25000.00000080.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414816674.0000000000A27000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_7_2_a00000_netconn_properties.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Process$CurrentExitTerminate
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1703294689-0
                                                                                                                                                  • Opcode ID: 237bc8902f2d4725bfd5275b473cdb6fba1f3da65f3c0877ac936613bb694fb0
                                                                                                                                                  • Instruction ID: a8fee80e1efe354cdd0d28a410168beda9fc11cc095689da41329f1780efaaa1
                                                                                                                                                  • Opcode Fuzzy Hash: 237bc8902f2d4725bfd5275b473cdb6fba1f3da65f3c0877ac936613bb694fb0
                                                                                                                                                  • Instruction Fuzzy Hash: AED09231104208AFCF21AFA0ED0D9DE3F3AAF49391B409410B90D4A0B2DB71DA93AA90
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00A0AE80 Relevance: 3.1, APIs: 2, Instructions: 65COMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  • Executed
                                                                                                                                                  • Not Executed
                                                                                                                                                  control_flow_graph 515 a0ae80-a0ae85 516 a0ae87-a0ae9f 515->516 517 a0aea1-a0aea5 516->517 518 a0aead-a0aeb6 516->518 517->518 519 a0aea7-a0aeab 517->519 520 a0aec8 518->520 521 a0aeb8-a0aebb 518->521 522 a0af22-a0af26 519->522 525 a0aeca-a0aed7 GetStdHandle 520->525 523 a0aec4-a0aec6 521->523 524 a0aebd-a0aec2 521->524 522->516 526 a0af2c-a0af2f 522->526 523->525 524->525 527 a0af04-a0af16 525->527 528 a0aed9-a0aedb 525->528 527->522 529 a0af18-a0af1b 527->529 528->527 530 a0aedd-a0aee6 GetFileType 528->530 529->522 530->527 531 a0aee8-a0aef1 530->531 532 a0aef3-a0aef7 531->532 533 a0aef9-a0aefc 531->533 532->522 533->522 534 a0aefe-a0af02 533->534 534->522
                                                                                                                                                  APIs
                                                                                                                                                  • GetStdHandle.KERNEL32(000000F6), ref: 00A0AECC
                                                                                                                                                  • GetFileType.KERNELBASE(00000000), ref: 00A0AEDE
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000007.00000002.2414728783.0000000000A01000.00000040.00000001.01000000.00000021.sdmp, Offset: 00A00000, based on PE: true
                                                                                                                                                  • Associated: 00000007.00000002.2414712056.0000000000A00000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A1F000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A24000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414797468.0000000000A25000.00000080.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414816674.0000000000A27000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_7_2_a00000_netconn_properties.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: FileHandleType
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3000768030-0
                                                                                                                                                  • Opcode ID: 07c5b6a559165a8d2c2baea380ccfd2c889428d512b1585868cec51dd5c39925
                                                                                                                                                  • Instruction ID: 71556e044f6fb69e6633832eae7b3f81695371a61b8137a060b8137ab2e70f33
                                                                                                                                                  • Opcode Fuzzy Hash: 07c5b6a559165a8d2c2baea380ccfd2c889428d512b1585868cec51dd5c39925
                                                                                                                                                  • Instruction Fuzzy Hash: 3D1184B160476A4AC7308B3DEC886627AA5A776331B38071AE1B7C75F1C334DD87D646
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00A038B5 Relevance: 1.5, APIs: 1, Instructions: 22COMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  • Executed
                                                                                                                                                  • Not Executed
                                                                                                                                                  control_flow_graph 535 a038b5 536 a038b8 call a03ece 535->536 537 a038bd-a038bf 536->537 538 a038c1-a038c5 537->538 539 a038f3-a03901 call a09bc2 call a03ce8 __scrt_common_main_seh 537->539 540 a038c7 call a09ba4 538->540 541 a038cc-a038d3 538->541 540->541 544 a038d6-a038e5 541->544
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 00A03ECE: GetModuleHandleW.KERNEL32(00000000,00A09A64,2EC2FEAC,?,00A09BD3), ref: 00A03ED0
                                                                                                                                                  • ___security_init_cookie.LIBCMT ref: 00A038FC
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000007.00000002.2414728783.0000000000A01000.00000040.00000001.01000000.00000021.sdmp, Offset: 00A00000, based on PE: true
                                                                                                                                                  • Associated: 00000007.00000002.2414712056.0000000000A00000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A1F000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A24000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414797468.0000000000A25000.00000080.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414816674.0000000000A27000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_7_2_a00000_netconn_properties.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: HandleModule___security_init_cookie
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1525027140-0
                                                                                                                                                  • Opcode ID: 6c86eecccad0cfbad3680f42d8b85d45ddf276b85981c2f06b6bf03fd3ea4200
                                                                                                                                                  • Instruction ID: 0e8f45295c3cf2152a6b804cce296b126d15231ff8164f5d1eed7d6a74bdbbf5
                                                                                                                                                  • Opcode Fuzzy Hash: 6c86eecccad0cfbad3680f42d8b85d45ddf276b85981c2f06b6bf03fd3ea4200
                                                                                                                                                  • Instruction Fuzzy Hash: EAE04F73A0434D8FDF10EBA4F6023EDB776FF85324F104556E411622D2D7355A158650
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Non-executed Functions

                                                                                                                                                  Function 00A105F0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000007.00000002.2414728783.0000000000A01000.00000040.00000001.01000000.00000021.sdmp, Offset: 00A00000, based on PE: true
                                                                                                                                                  • Associated: 00000007.00000002.2414712056.0000000000A00000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A1F000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A24000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414797468.0000000000A25000.00000080.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414816674.0000000000A27000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_7_2_a00000_netconn_properties.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID:
                                                                                                                                                  • Opcode ID: 63c99720e4052abba5412a8387a14668e892786368012778eac4097f0a5c2c15
                                                                                                                                                  • Instruction ID: 471f885cd0b58905d1ad6fe9bb7fa099e7655dc683c610dee76ce84c59e1c720
                                                                                                                                                  • Opcode Fuzzy Hash: 63c99720e4052abba5412a8387a14668e892786368012778eac4097f0a5c2c15
                                                                                                                                                  • Instruction Fuzzy Hash: 43021C71E012199FDF14CFA9C990AEEBBB1FF48314F248269E519E7381D771A981CB90
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00A03DAE Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00A03DBA
                                                                                                                                                  • IsDebuggerPresent.KERNEL32 ref: 00A03E86
                                                                                                                                                  • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00A03EA6
                                                                                                                                                  • UnhandledExceptionFilter.KERNEL32(?), ref: 00A03EB0
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000007.00000002.2414728783.0000000000A01000.00000040.00000001.01000000.00000021.sdmp, Offset: 00A00000, based on PE: true
                                                                                                                                                  • Associated: 00000007.00000002.2414712056.0000000000A00000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A1F000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A24000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414797468.0000000000A25000.00000080.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414816674.0000000000A27000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_7_2_a00000_netconn_properties.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 254469556-0
                                                                                                                                                  • Opcode ID: 9d9b3baf93a7a1029f075312cf7da090788b5f2e978ae40e30eaba4fda07e0a9
                                                                                                                                                  • Instruction ID: 31664d29f2f0d2ada93799cc912692a980de08c1cb056ff9dd96bc0d10f99c04
                                                                                                                                                  • Opcode Fuzzy Hash: 9d9b3baf93a7a1029f075312cf7da090788b5f2e978ae40e30eaba4fda07e0a9
                                                                                                                                                  • Instruction Fuzzy Hash: 02312775D4531D9BDF20DFA4E9897CDBBB8BF08300F1041AAE409AB290EB719B858F44
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00A04F4B Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  • Executed
                                                                                                                                                  • Not Executed
                                                                                                                                                  control_flow_graph 671 a04f4b-a04f76 call a05ed0 674 a052ea-a052ef call a0a2e9 671->674 675 a04f7c-a04f7f 671->675 675->674 677 a04f85-a04f8e 675->677 679 a04f94-a04f98 677->679 680 a0508b-a05091 677->680 679->680 681 a04f9e-a04fa5 679->681 682 a05099-a050a7 680->682 683 a04fa7-a04fae 681->683 684 a04fbd-a04fc2 681->684 685 a05253-a05256 682->685 686 a050ad-a050b1 682->686 683->684 687 a04fb0-a04fb7 683->687 684->680 688 a04fc8-a04fd0 call a04c06 684->688 689 a05258-a0525b 685->689 690 a05279-a05282 call a04c06 685->690 686->685 691 a050b7-a050be 686->691 687->680 687->684 705 a05284-a05288 688->705 706 a04fd6-a04fef call a04c06 * 2 688->706 689->674 693 a05261-a05276 call a052f0 689->693 690->674 690->705 694 a050c0-a050c7 691->694 695 a050d6-a050dc 691->695 693->690 694->695 699 a050c9-a050d0 694->699 700 a050e2-a05109 call a04215 695->700 701 a051f3-a051f7 695->701 699->685 699->695 700->701 717 a0510f-a05112 700->717 703 a05203-a0520f 701->703 704 a051f9-a05202 call a0464d 701->704 703->690 710 a05211-a0521b 703->710 704->703 706->674 732 a04ff5-a04ffb 706->732 714 a05229-a0522b 710->714 715 a0521d-a0521f 710->715 719 a05242-a0524f call a05969 714->719 720 a0522d-a05240 call a04c06 * 2 714->720 715->690 718 a05221-a05225 715->718 722 a05115-a0512a 717->722 718->690 724 a05227 718->724 735 a05251 719->735 736 a052ae-a052c3 call a04c06 * 2 719->736 749 a05289 call a0a2ad 720->749 727 a05130-a05133 722->727 728 a051d4-a051e7 722->728 724->720 727->728 729 a05139-a05141 727->729 728->722 733 a051ed-a051f0 728->733 729->728 734 a05147-a0515b 729->734 738 a05027-a0502f call a04c06 732->738 739 a04ffd-a05001 732->739 733->701 740 a0515e-a0516f 734->740 735->690 767 a052c5 736->767 768 a052c8-a052e5 call a04408 call a05869 call a05a26 call a057e0 736->768 754 a05031-a05051 call a04c06 * 2 call a05969 738->754 755 a05093-a05096 738->755 739->738 744 a05003-a0500a 739->744 745 a05171-a05182 call a05426 740->745 746 a05195-a051a2 740->746 750 a0500c-a05013 744->750 751 a0501e-a05021 744->751 764 a05184-a0518d 745->764 765 a051a6-a051ce call a04ecb 745->765 746->740 757 a051a4 746->757 763 a0528e-a052a9 call a0464d call a055da call a0480b 749->763 750->751 752 a05015-a0501c 750->752 751->674 751->738 752->738 752->751 754->755 785 a05053-a05058 754->785 755->682 762 a051d1 757->762 762->728 763->736 764->745 771 a0518f-a05192 764->771 765->762 767->768 768->674 771->746 785->749 788 a0505e-a05071 call a055f2 785->788 788->763 792 a05077-a05083 788->792 792->749 793 a05089 792->793 793->788
                                                                                                                                                  APIs
                                                                                                                                                  • type_info::operator==.LIBVCRUNTIME ref: 00A0506A
                                                                                                                                                  • ___TypeMatch.LIBVCRUNTIME ref: 00A05178
                                                                                                                                                  • _UnwindNestedFrames.LIBCMT ref: 00A052CA
                                                                                                                                                  • CallUnexpected.LIBVCRUNTIME ref: 00A052E5
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000007.00000002.2414728783.0000000000A01000.00000040.00000001.01000000.00000021.sdmp, Offset: 00A00000, based on PE: true
                                                                                                                                                  • Associated: 00000007.00000002.2414712056.0000000000A00000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A1F000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A24000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414797468.0000000000A25000.00000080.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414816674.0000000000A27000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_7_2_a00000_netconn_properties.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
                                                                                                                                                  • String ID: csm$csm$csm
                                                                                                                                                  • API String ID: 2751267872-393685449
                                                                                                                                                  • Opcode ID: db42e852309423f1400f7a42c266963aa1784bde8070b286f332c6bed1e8b2f9
                                                                                                                                                  • Instruction ID: 5990ad8bceef39fe051b2842832529192fcbb569a85cd36e391507ab0a57c9cc
                                                                                                                                                  • Opcode Fuzzy Hash: db42e852309423f1400f7a42c266963aa1784bde8070b286f332c6bed1e8b2f9
                                                                                                                                                  • Instruction Fuzzy Hash: 13B168B1D0060DEFCF18DFA4E9819AFBBB5BF18310B14455AE8116B292D731DA61CF91
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00A14230 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  • Executed
                                                                                                                                                  • Not Executed
                                                                                                                                                  control_flow_graph 794 a14230-a14262 795 a14274-a14277 794->795 796 a14264-a14272 call a140dc 794->796 798 a14478 795->798 799 a1427d-a14282 795->799 796->799 803 a1447a-a1448b call a03646 798->803 801 a14294-a14297 799->801 802 a14284-a14292 call a140dc 799->802 801->798 805 a1429d-a142a2 801->805 802->805 808 a142a4-a142ac 805->808 809 a142af-a142b1 805->809 808->809 811 a142b3-a142b5 809->811 812 a142bb-a142bd 809->812 811->812 813 a1435a-a14372 call a0dd92 811->813 814 a142c3-a142c6 812->814 815 a144c8 812->815 813->798 823 a14378-a14384 813->823 817 a14352-a14355 814->817 818 a142cc-a142cf 814->818 817->803 819 a142d1-a142de GetCPInfo 818->819 820 a14317-a1431a 818->820 819->798 822 a142e4-a142e6 819->822 820->803 824 a142e8-a142ec 822->824 825 a1431f-a14321 822->825 826 a144c4-a144c6 823->826 827 a1438a-a1438f 823->827 824->820 828 a142ee-a142f5 824->828 825->813 831 a14323-a14327 825->831 832 a144bd-a144c2 call a0e97b 826->832 829 a14391-a1439a call a162a0 827->829 830 a143a8-a143b3 call a0afbc 827->830 828->820 833 a142f7 828->833 829->826 844 a143a0-a143a6 829->844 830->826 847 a143b9 830->847 831->817 836 a14329-a14330 831->836 845 a14477 832->845 838 a142fa-a142ff 833->838 836->817 841 a14332 836->841 838->820 843 a14301-a14305 838->843 846 a14335-a1433a 841->846 849 a14307-a14309 843->849 850 a1430f-a14315 843->850 848 a143bf-a143c4 844->848 845->798 846->817 851 a1433c-a14340 846->851 847->848 848->826 854 a143ca-a143e2 call a0dd92 848->854 849->815 849->850 850->820 850->838 852 a14342-a14344 851->852 853 a1434a-a14350 851->853 852->815 852->853 853->817 853->846 857 a143e8-a14401 call a0dd92 854->857 858 a144bc 854->858 857->858 861 a14407-a14413 857->861 858->832 862 a14419-a1441e 861->862 863 a144b8-a144ba 861->863 865 a14420-a14429 call a162a0 862->865 866 a14437-a14442 call a0afbc 862->866 864 a1446b-a14476 call a0e97b * 2 863->864 864->845 865->863 875 a1442f-a14435 865->875 866->863 873 a14444 866->873 876 a1444a-a1444f 873->876 875->876 876->863 878 a14451-a14468 call a0dd92 876->878 881 a1446a 878->881 882 a1448c-a144b6 call a0a7b0 call a0e97b * 2 878->882 881->864 882->803
                                                                                                                                                  APIs
                                                                                                                                                  • GetCPInfo.KERNEL32(00BB21B8,00BB21B8,?,7FFFFFFF,?,00A14500,00BB21B8,00BB21B8,?,00BB21B8,?,?,?,?,00BB21B8,?), ref: 00A142D6
                                                                                                                                                  • __alloca_probe_16.LIBCMT ref: 00A14391
                                                                                                                                                  • __alloca_probe_16.LIBCMT ref: 00A14420
                                                                                                                                                  • __freea.LIBCMT ref: 00A1446B
                                                                                                                                                  • __freea.LIBCMT ref: 00A14471
                                                                                                                                                  • __freea.LIBCMT ref: 00A144A7
                                                                                                                                                  • __freea.LIBCMT ref: 00A144AD
                                                                                                                                                  • __freea.LIBCMT ref: 00A144BD
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000007.00000002.2414728783.0000000000A01000.00000040.00000001.01000000.00000021.sdmp, Offset: 00A00000, based on PE: true
                                                                                                                                                  • Associated: 00000007.00000002.2414712056.0000000000A00000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A1F000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A24000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414797468.0000000000A25000.00000080.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414816674.0000000000A27000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_7_2_a00000_netconn_properties.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: __freea$__alloca_probe_16$Info
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 127012223-0
                                                                                                                                                  • Opcode ID: 450ac4a50a87a5be52b3cf531268eeb1a266f1d24e41757b60762c29caab65b7
                                                                                                                                                  • Instruction ID: 6c46e9d0c65623377190374956435f5a42f07a7beb590c67bdb470de3b61e239
                                                                                                                                                  • Opcode Fuzzy Hash: 450ac4a50a87a5be52b3cf531268eeb1a266f1d24e41757b60762c29caab65b7
                                                                                                                                                  • Instruction Fuzzy Hash: B571F772904209ABDF219FAC8D81BEF7BB99F4D710F290159F954AB281E735DC818760
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00A0B49D Relevance: 10.8, APIs: 7, Instructions: 329COMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  • Executed
                                                                                                                                                  • Not Executed
                                                                                                                                                  control_flow_graph 889 a0b49d-a0b4ae 890 a0b4b0 889->890 891 a0b4b2-a0b4bd 889->891 890->891 892 a0b4e1-a0b4f4 891->892 893 a0b4bf-a0b4dc call a08f53 891->893 895 a0b4f6-a0b516 call a0b7ca 892->895 896 a0b549-a0b54c 892->896 903 a0b7c6-a0b7c9 893->903 910 a0b520-a0b52c call a16390 895->910 911 a0b518-a0b51b 895->911 899 a0b558-a0b589 896->899 900 a0b54e 896->900 901 a0b5a9 899->901 902 a0b58b-a0b599 899->902 905 a0b550-a0b552 900->905 906 a0b554-a0b557 900->906 909 a0b5ac-a0b5b1 901->909 907 a0b5a0-a0b5a7 902->907 908 a0b59b-a0b59e 902->908 905->899 905->906 906->899 907->909 908->909 912 a0b5b3-a0b5b5 909->912 913 a0b5b7-a0b5be 909->913 921 a0b532-a0b544 910->921 922 a0b7c3 910->922 914 a0b7c5 911->914 916 a0b5da-a0b5e7 912->916 917 a0b5c0-a0b5ca call a089d0 913->917 918 a0b5cd-a0b5d8 913->918 914->903 923 a0b5f2-a0b602 916->923 924 a0b5e9-a0b5ec 916->924 917->918 918->916 921->922 922->914 925 a0b605-a0b615 923->925 924->923 927 a0b6b1-a0b6b3 924->927 928 a0b667-a0b67c call a0bcdd 925->928 929 a0b617-a0b63b call a16280 925->929 930 a0b6c5-a0b6cb 927->930 931 a0b6b5-a0b6c3 call a04a90 927->931 928->930 943 a0b67e-a0b684 928->943 941 a0b640-a0b663 929->941 942 a0b63d 929->942 935 a0b6cd 930->935 936 a0b6cf-a0b6fa call a16280 930->936 931->930 935->936 947 a0b706-a0b70f 936->947 948 a0b6fc 936->948 941->925 945 a0b665 941->945 942->941 946 a0b687-a0b68c 943->946 945->927 950 a0b693-a0b696 946->950 951 a0b68e-a0b691 946->951 949 a0b710-a0b71c 947->949 952 a0b702-a0b704 948->952 953 a0b6fe-a0b700 948->953 954 a0b722-a0b727 949->954 955 a0b7b8-a0b7bf 949->955 950->946 951->950 956 a0b698-a0b69e 951->956 952->949 953->947 953->952 957 a0b729-a0b72b 954->957 958 a0b72d-a0b759 call a160f0 call a161a0 954->958 955->922 959 a0b6a0-a0b6a3 956->959 960 a0b6ae 956->960 957->958 963 a0b75b-a0b75d 957->963 958->963 969 a0b766-a0b78b call a160f0 call a161a0 958->969 961 a0b6a5 959->961 962 a0b6a8-a0b6ac 959->962 960->927 961->962 962->927 963->955 966 a0b75f 963->966 968 a0b761-a0b764 966->968 966->969 968->969 971 a0b78d-a0b78f 968->971 969->971 976 a0b798-a0b7b6 call a160f0 call a161a0 969->976 971->955 973 a0b791 971->973 975 a0b793-a0b796 973->975 973->976 975->955 975->976 976->955
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000007.00000002.2414728783.0000000000A01000.00000040.00000001.01000000.00000021.sdmp, Offset: 00A00000, based on PE: true
                                                                                                                                                  • Associated: 00000007.00000002.2414712056.0000000000A00000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A1F000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A24000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414797468.0000000000A25000.00000080.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414816674.0000000000A27000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_7_2_a00000_netconn_properties.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: _strrchr
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3213747228-0
                                                                                                                                                  • Opcode ID: 7c616c77292262d527fe6da345d05dc2c9c836dbc2505f574d420a347d760d19
                                                                                                                                                  • Instruction ID: b6bc7dbd029444030e580c2f4c1b99b62e413d5bfd554428c6e4ba7b5faf7307
                                                                                                                                                  • Opcode Fuzzy Hash: 7c616c77292262d527fe6da345d05dc2c9c836dbc2505f574d420a347d760d19
                                                                                                                                                  • Instruction Fuzzy Hash: D1B166329212599FDB11CF28DE81BEE7BB5EF95310F1441A5E901AB2C2D375E940CBB0
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00A048C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  • Executed
                                                                                                                                                  • Not Executed
                                                                                                                                                  control_flow_graph 983 a048c0-a04911 call a165fb call a04880 call a05a8c 990 a04913-a04925 983->990 991 a0496d-a04970 983->991 992 a04990-a04999 990->992 994 a04927-a0493e 990->994 991->992 993 a04972-a0497f call a05c10 991->993 1000 a04984-a0498d call a04880 993->1000 996 a04940-a0494e call a05bb0 994->996 997 a04954 994->997 1004 a04950 996->1004 1005 a04964-a0496b 996->1005 999 a04957-a0495c 997->999 999->994 1002 a0495e-a04960 999->1002 1000->992 1002->992 1006 a04962 1002->1006 1008 a04952 1004->1008 1009 a0499a-a049a3 1004->1009 1005->1000 1006->1000 1008->999 1010 a049a5-a049ac 1009->1010 1011 a049dd-a049ed call a05bf0 1009->1011 1010->1011 1012 a049ae-a049bd call a15e50 1010->1012 1017 a04a01-a04a1d call a04880 call a05bd0 1011->1017 1018 a049ef-a049fe call a05c10 1011->1018 1020 a049da 1012->1020 1021 a049bf-a049d7 1012->1021 1018->1017 1020->1011 1021->1020
                                                                                                                                                  APIs
                                                                                                                                                  • _ValidateLocalCookies.LIBCMT ref: 00A048F7
                                                                                                                                                  • ___except_validate_context_record.LIBVCRUNTIME ref: 00A048FF
                                                                                                                                                  • _ValidateLocalCookies.LIBCMT ref: 00A04988
                                                                                                                                                  • __IsNonwritableInCurrentImage.LIBCMT ref: 00A049B3
                                                                                                                                                  • _ValidateLocalCookies.LIBCMT ref: 00A04A08
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000007.00000002.2414728783.0000000000A01000.00000040.00000001.01000000.00000021.sdmp, Offset: 00A00000, based on PE: true
                                                                                                                                                  • Associated: 00000007.00000002.2414712056.0000000000A00000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A1F000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A24000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414797468.0000000000A25000.00000080.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414816674.0000000000A27000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_7_2_a00000_netconn_properties.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                                                                                                                  • String ID: csm
                                                                                                                                                  • API String ID: 1170836740-1018135373
                                                                                                                                                  • Opcode ID: 0a45103e4ef4f7ac9db9670a21f678e4280fcd8cd6b4345ae078f1bf6fbd07a6
                                                                                                                                                  • Instruction ID: 5e5826152a7bdd39b6a7bbc2576e504fd77ce0037a83031f3eeaf3501278ed96
                                                                                                                                                  • Opcode Fuzzy Hash: 0a45103e4ef4f7ac9db9670a21f678e4280fcd8cd6b4345ae078f1bf6fbd07a6
                                                                                                                                                  • Instruction Fuzzy Hash: 6D41A274E0020DABCF10DF68E884A9FBBB5BF49354F148165E9185B3D2D731AE55CB90
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00A0A601 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  • Executed
                                                                                                                                                  • Not Executed
                                                                                                                                                  control_flow_graph 1029 a0a601-a0a60d 1030 a0a69f-a0a6a2 1029->1030 1031 a0a612-a0a623 1030->1031 1032 a0a6a8 1030->1032 1034 a0a630-a0a649 LoadLibraryExW 1031->1034 1035 a0a625-a0a628 1031->1035 1033 a0a6aa-a0a6ae 1032->1033 1036 a0a64b-a0a654 GetLastError 1034->1036 1037 a0a6af-a0a6bf 1034->1037 1038 a0a6c8-a0a6ca 1035->1038 1039 a0a62e 1035->1039 1041 a0a656-a0a668 call a0a418 1036->1041 1042 a0a68d-a0a69a 1036->1042 1037->1038 1043 a0a6c1-a0a6c2 FreeLibrary 1037->1043 1038->1033 1040 a0a69c 1039->1040 1040->1030 1041->1042 1046 a0a66a-a0a67c call a0a418 1041->1046 1042->1040 1043->1038 1046->1042 1049 a0a67e-a0a68b LoadLibraryExW 1046->1049 1049->1037 1049->1042
                                                                                                                                                  APIs
                                                                                                                                                  • FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,2EC2FEAC,?,00A0A710,00A073C6,?,00000000,?), ref: 00A0A6C2
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000007.00000002.2414728783.0000000000A01000.00000040.00000001.01000000.00000021.sdmp, Offset: 00A00000, based on PE: true
                                                                                                                                                  • Associated: 00000007.00000002.2414712056.0000000000A00000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A1F000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A24000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414797468.0000000000A25000.00000080.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414816674.0000000000A27000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_7_2_a00000_netconn_properties.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: FreeLibrary
                                                                                                                                                  • String ID: api-ms-$ext-ms-
                                                                                                                                                  • API String ID: 3664257935-537541572
                                                                                                                                                  • Opcode ID: 64c9ca6bf4fb91131a4b206db3aa7800d7e996d6de06e1aa596f88d3d207b0b5
                                                                                                                                                  • Instruction ID: c0b11d21f6ece1dddd7770d568e31ee1edd8367e574fe73a5e09e768371908ea
                                                                                                                                                  • Opcode Fuzzy Hash: 64c9ca6bf4fb91131a4b206db3aa7800d7e996d6de06e1aa596f88d3d207b0b5
                                                                                                                                                  • Instruction Fuzzy Hash: 2F210D35A41318ABCB21DB61FC40E9E37799B61760F294220F905A72D0E771ED01CAE2
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00A04C14 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  • Executed
                                                                                                                                                  • Not Executed
                                                                                                                                                  control_flow_graph 1449 a04c14-a04c1b 1450 a04c20-a04c3b GetLastError call a05df3 1449->1450 1451 a04c1d-a04c1f 1449->1451 1454 a04c54-a04c56 1450->1454 1455 a04c3d-a04c3f 1450->1455 1457 a04c9a-a04ca5 SetLastError 1454->1457 1456 a04c41-a04c52 call a05e2e 1455->1456 1455->1457 1456->1454 1460 a04c58-a04c68 call a0a387 1456->1460 1463 a04c6a-a04c7a call a05e2e 1460->1463 1464 a04c7c-a04c8c call a05e2e 1460->1464 1463->1464 1470 a04c8e-a04c90 1463->1470 1469 a04c92-a04c99 call a09db4 1464->1469 1469->1457 1470->1469
                                                                                                                                                  APIs
                                                                                                                                                  • GetLastError.KERNEL32(?,?,00A04C0B,00A047F9,00A03F60), ref: 00A04C22
                                                                                                                                                  • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00A04C30
                                                                                                                                                  • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00A04C49
                                                                                                                                                  • SetLastError.KERNEL32(00000000,00A04C0B,00A047F9,00A03F60), ref: 00A04C9B
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000007.00000002.2414728783.0000000000A01000.00000040.00000001.01000000.00000021.sdmp, Offset: 00A00000, based on PE: true
                                                                                                                                                  • Associated: 00000007.00000002.2414712056.0000000000A00000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A1F000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A24000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414797468.0000000000A25000.00000080.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414816674.0000000000A27000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_7_2_a00000_netconn_properties.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ErrorLastValue___vcrt_
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 3852720340-0
                                                                                                                                                  • Opcode ID: aeba70aeb5adfa87fc77ec8ac2f53d02511537277aa82d591cabf50c88371586
                                                                                                                                                  • Instruction ID: 6d1bb6ad1dbbd1a7347145d81c5508e0ad29b6e6373cff355cedfde935fbb5b7
                                                                                                                                                  • Opcode Fuzzy Hash: aeba70aeb5adfa87fc77ec8ac2f53d02511537277aa82d591cabf50c88371586
                                                                                                                                                  • Instruction Fuzzy Hash: F901477290A7296EF714A7F4BD896AB27ADFB0D331330023AF214450F2FF114C029550
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00A0D297 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  Strings
                                                                                                                                                  • C:\Users\user\AppData\Local\Temp\_MEI12682\exe\netconn_properties.exe, xrefs: 00A0D2B3
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000007.00000002.2414728783.0000000000A01000.00000040.00000001.01000000.00000021.sdmp, Offset: 00A00000, based on PE: true
                                                                                                                                                  • Associated: 00000007.00000002.2414712056.0000000000A00000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A1F000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A24000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414797468.0000000000A25000.00000080.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414816674.0000000000A27000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_7_2_a00000_netconn_properties.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID:
                                                                                                                                                  • String ID: C:\Users\user\AppData\Local\Temp\_MEI12682\exe\netconn_properties.exe
                                                                                                                                                  • API String ID: 0-394872426
                                                                                                                                                  • Opcode ID: 8d6007c5517106247ee7d68d884ecc8c6258e172b1ca1a3272c4880cb3e44920
                                                                                                                                                  • Instruction ID: 02401d33c03388785ca844a8330c51eed07062f9b0f428058805be07e721fff4
                                                                                                                                                  • Opcode Fuzzy Hash: 8d6007c5517106247ee7d68d884ecc8c6258e172b1ca1a3272c4880cb3e44920
                                                                                                                                                  • Instruction Fuzzy Hash: 2F219A33A0020DAFDB20AFE1ED4996B77A9AF443647148914F915DB1C0EB71EC00CBA3
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00A09B13 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,2EC2FEAC,?,?,00000000,00A168D1,000000FF,?,00A09AEF,00A09BD3,?,00A09AC3,00000000), ref: 00A09B48
                                                                                                                                                  • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00A09B5A
                                                                                                                                                  • FreeLibrary.KERNEL32(00000000,?,?,00000000,00A168D1,000000FF,?,00A09AEF,00A09BD3,?,00A09AC3,00000000), ref: 00A09B7C
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000007.00000002.2414728783.0000000000A01000.00000040.00000001.01000000.00000021.sdmp, Offset: 00A00000, based on PE: true
                                                                                                                                                  • Associated: 00000007.00000002.2414712056.0000000000A00000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A1F000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A24000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414797468.0000000000A25000.00000080.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414816674.0000000000A27000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_7_2_a00000_netconn_properties.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                  • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                  • API String ID: 4061214504-1276376045
                                                                                                                                                  • Opcode ID: 3df772f7ebcf63b2efe33b587108318521cbc868041487d80c64e68e6d4f8e7f
                                                                                                                                                  • Instruction ID: f0e05f78b596a2cb87a15b101971d35badb891e2743fc7183b33b5fdeaaaadea
                                                                                                                                                  • Opcode Fuzzy Hash: 3df772f7ebcf63b2efe33b587108318521cbc868041487d80c64e68e6d4f8e7f
                                                                                                                                                  • Instruction Fuzzy Hash: 6A014431944619FBDB119F94EC05FEFBBB8FB08721F004625B815A22D0DB749D41CA50
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00A12C04 Relevance: 7.7, APIs: 5, Instructions: 197COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • __alloca_probe_16.LIBCMT ref: 00A12C89
                                                                                                                                                  • __alloca_probe_16.LIBCMT ref: 00A12D52
                                                                                                                                                  • __freea.LIBCMT ref: 00A12DB9
                                                                                                                                                    • Part of subcall function 00A0AFBC: RtlAllocateHeap.NTDLL(00000000,?,?), ref: 00A0AFEE
                                                                                                                                                  • __freea.LIBCMT ref: 00A12DCC
                                                                                                                                                  • __freea.LIBCMT ref: 00A12DD9
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000007.00000002.2414728783.0000000000A01000.00000040.00000001.01000000.00000021.sdmp, Offset: 00A00000, based on PE: true
                                                                                                                                                  • Associated: 00000007.00000002.2414712056.0000000000A00000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A1F000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A24000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414797468.0000000000A25000.00000080.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414816674.0000000000A27000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_7_2_a00000_netconn_properties.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: __freea$__alloca_probe_16$AllocateHeap
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1423051803-0
                                                                                                                                                  • Opcode ID: 9c960fafc6e93f993d96c1218d550043421cf3d88ebb99eec18b1ff79fb1d78f
                                                                                                                                                  • Instruction ID: 7e9879789b582fcc16c3b963d6d8f236615a02b2e28664802f1e86bc84103fca
                                                                                                                                                  • Opcode Fuzzy Hash: 9c960fafc6e93f993d96c1218d550043421cf3d88ebb99eec18b1ff79fb1d78f
                                                                                                                                                  • Instruction Fuzzy Hash: 4A51B37260060AAFEF219FA1ED81FFB76A9EF94750B150528FD04D6190FB74CCA097A0
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00A05D32 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00A05CE3,00000000,?,00A1FD10,?,?,?,00A05E86,00000004,InitializeCriticalSectionEx,00A17CC4,InitializeCriticalSectionEx), ref: 00A05D3F
                                                                                                                                                  • GetLastError.KERNEL32(?,00A05CE3,00000000,?,00A1FD10,?,?,?,00A05E86,00000004,InitializeCriticalSectionEx,00A17CC4,InitializeCriticalSectionEx,00000000,?,00A05C3D), ref: 00A05D49
                                                                                                                                                  • LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00A05D71
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000007.00000002.2414728783.0000000000A01000.00000040.00000001.01000000.00000021.sdmp, Offset: 00A00000, based on PE: true
                                                                                                                                                  • Associated: 00000007.00000002.2414712056.0000000000A00000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A1F000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A24000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414797468.0000000000A25000.00000080.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414816674.0000000000A27000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_7_2_a00000_netconn_properties.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: LibraryLoad$ErrorLast
                                                                                                                                                  • String ID: api-ms-
                                                                                                                                                  • API String ID: 3177248105-2084034818
                                                                                                                                                  • Opcode ID: 2a91e06a81aa38dd768b307211bfe8e10ff849b1245285bcece65cbd4719e8ac
                                                                                                                                                  • Instruction ID: beb28ceeef08d32606df27a2590db1934661f27e857ea59ef836e2a46597660d
                                                                                                                                                  • Opcode Fuzzy Hash: 2a91e06a81aa38dd768b307211bfe8e10ff849b1245285bcece65cbd4719e8ac
                                                                                                                                                  • Instruction Fuzzy Hash: 7FE04F35AC470CB7EF109BB0FC8AB9E3A64AB10B40F209021F90CE84E0E7A2D85189D4
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00A0F973 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetConsoleOutputCP.KERNEL32(2EC2FEAC,00000000,00000000,?), ref: 00A0F9D6
                                                                                                                                                    • Part of subcall function 00A0DE4C: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00A12DAF,?,00000000,-00000008), ref: 00A0DEAD
                                                                                                                                                  • WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00A0FC28
                                                                                                                                                  • WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00A0FC6E
                                                                                                                                                  • GetLastError.KERNEL32 ref: 00A0FD11
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000007.00000002.2414728783.0000000000A01000.00000040.00000001.01000000.00000021.sdmp, Offset: 00A00000, based on PE: true
                                                                                                                                                  • Associated: 00000007.00000002.2414712056.0000000000A00000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A1F000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A24000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414797468.0000000000A25000.00000080.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414816674.0000000000A27000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_7_2_a00000_netconn_properties.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2112829910-0
                                                                                                                                                  • Opcode ID: 09557208a7b14eac8d509c1406db1fea48eddd93a59d4e21e664e2fd4f6aaee7
                                                                                                                                                  • Instruction ID: 9534c9c1fdb88a834f8eb375464e88b49e698a291040c501fc57c132a0c7855e
                                                                                                                                                  • Opcode Fuzzy Hash: 09557208a7b14eac8d509c1406db1fea48eddd93a59d4e21e664e2fd4f6aaee7
                                                                                                                                                  • Instruction Fuzzy Hash: FCD17A75D0025CAFDF25CFE8E8909EDBBB5FF09314F28412AE855EB691D630A942CB50
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00A04CF4 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000007.00000002.2414728783.0000000000A01000.00000040.00000001.01000000.00000021.sdmp, Offset: 00A00000, based on PE: true
                                                                                                                                                  • Associated: 00000007.00000002.2414712056.0000000000A00000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A1F000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A24000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414797468.0000000000A25000.00000080.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414816674.0000000000A27000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_7_2_a00000_netconn_properties.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: AdjustPointer
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1740715915-0
                                                                                                                                                  • Opcode ID: dc658bb07ad9ecc0bd261a897c7534b605cf41760c37fc3b4f16c55b3220fe0d
                                                                                                                                                  • Instruction ID: c5b28c1fbf910d5b9daf88b7b10a5107b2c8144e9ed2f82f1ce1d3c4f3b8c6e0
                                                                                                                                                  • Opcode Fuzzy Hash: dc658bb07ad9ecc0bd261a897c7534b605cf41760c37fc3b4f16c55b3220fe0d
                                                                                                                                                  • Instruction Fuzzy Hash: 4C51AFF2A0160AAFEB258F64F981BAA77B4FF08711F244529EA05871D1D731AC91CB90
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00A0CAB1 Relevance: 6.1, APIs: 4, Instructions: 82COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 00A0DE4C: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00A12DAF,?,00000000,-00000008), ref: 00A0DEAD
                                                                                                                                                  • GetLastError.KERNEL32 ref: 00A0CB15
                                                                                                                                                  • __dosmaperr.LIBCMT ref: 00A0CB1C
                                                                                                                                                  • GetLastError.KERNEL32(?,?,?,?), ref: 00A0CB56
                                                                                                                                                  • __dosmaperr.LIBCMT ref: 00A0CB5D
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000007.00000002.2414728783.0000000000A01000.00000040.00000001.01000000.00000021.sdmp, Offset: 00A00000, based on PE: true
                                                                                                                                                  • Associated: 00000007.00000002.2414712056.0000000000A00000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A1F000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A24000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414797468.0000000000A25000.00000080.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414816674.0000000000A27000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_7_2_a00000_netconn_properties.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ErrorLast__dosmaperr$ByteCharMultiWide
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1913693674-0
                                                                                                                                                  • Opcode ID: ba5a31c339b26d440cef77b4e820f892b5193ca462175906e4ea6b86a9cd45f7
                                                                                                                                                  • Instruction ID: 65a67ec193bd4861f1b75d9f489c091d34a54d92adb8e160cfb8405b93e81a77
                                                                                                                                                  • Opcode Fuzzy Hash: ba5a31c339b26d440cef77b4e820f892b5193ca462175906e4ea6b86a9cd45f7
                                                                                                                                                  • Instruction Fuzzy Hash: 0121D03160031DAFCB20EFA1E98196BB7A9EF023707108718F91A971D0EB71EC0087A1
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00A0DEEF Relevance: 6.1, APIs: 4, Instructions: 74COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • GetEnvironmentStringsW.KERNEL32 ref: 00A0DEF7
                                                                                                                                                    • Part of subcall function 00A0DE4C: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,00A12DAF,?,00000000,-00000008), ref: 00A0DEAD
                                                                                                                                                  • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00A0DF2F
                                                                                                                                                  • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00A0DF4F
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000007.00000002.2414728783.0000000000A01000.00000040.00000001.01000000.00000021.sdmp, Offset: 00A00000, based on PE: true
                                                                                                                                                  • Associated: 00000007.00000002.2414712056.0000000000A00000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A1F000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A24000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414797468.0000000000A25000.00000080.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414816674.0000000000A27000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_7_2_a00000_netconn_properties.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: EnvironmentStrings$Free$ByteCharMultiWide
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 158306478-0
                                                                                                                                                  • Opcode ID: 8ae7bb95d4246ebc86b04b30b1ed1d3c6e670ce24f6060918ad4f5af5542185e
                                                                                                                                                  • Instruction ID: 5f94c04fd854e82214da5470ea10fe146821676cc959e9b70e09434ac6337b42
                                                                                                                                                  • Opcode Fuzzy Hash: 8ae7bb95d4246ebc86b04b30b1ed1d3c6e670ce24f6060918ad4f5af5542185e
                                                                                                                                                  • Instruction Fuzzy Hash: 881104B390971EBEE71167F5BD89CAF696CDE983943104124F406A2181FE70DD0145B2
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00A1456A Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,00A13613,00000000,00000001,?,?,?,00A0FD65,?,00000000,00000000), ref: 00A14581
                                                                                                                                                  • GetLastError.KERNEL32(?,00A13613,00000000,00000001,?,?,?,00A0FD65,?,00000000,00000000,?,?,?,00A10308,?), ref: 00A1458D
                                                                                                                                                    • Part of subcall function 00A14553: CloseHandle.KERNEL32(FFFFFFFE,00A1459D,?,00A13613,00000000,00000001,?,?,?,00A0FD65,?,00000000,00000000,?,?), ref: 00A14563
                                                                                                                                                  • ___initconout.LIBCMT ref: 00A1459D
                                                                                                                                                    • Part of subcall function 00A14515: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00A14544,00A13600,?,?,00A0FD65,?,00000000,00000000,?), ref: 00A14528
                                                                                                                                                  • WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,00A13613,00000000,00000001,?,?,?,00A0FD65,?,00000000,00000000,?), ref: 00A145B2
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000007.00000002.2414728783.0000000000A01000.00000040.00000001.01000000.00000021.sdmp, Offset: 00A00000, based on PE: true
                                                                                                                                                  • Associated: 00000007.00000002.2414712056.0000000000A00000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A1F000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A24000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414797468.0000000000A25000.00000080.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414816674.0000000000A27000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_7_2_a00000_netconn_properties.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 2744216297-0
                                                                                                                                                  • Opcode ID: cfc357ddf1bc9ac77572bb97da958d960a6ca17e0854e12dd83c8c8f5d2381f9
                                                                                                                                                  • Instruction ID: 478b717cb72d86e0ad882c212cf9083b47a74d06c833f375786357223a99ebec
                                                                                                                                                  • Opcode Fuzzy Hash: cfc357ddf1bc9ac77572bb97da958d960a6ca17e0854e12dd83c8c8f5d2381f9
                                                                                                                                                  • Instruction Fuzzy Hash: EFF0AC36540269BBCF226FE9DC089EE3F67FB4C7B1B048010FA1D95121D6328D619B90
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00A052F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • RtlEncodePointer.NTDLL(00000000), ref: 00A05315
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000007.00000002.2414728783.0000000000A01000.00000040.00000001.01000000.00000021.sdmp, Offset: 00A00000, based on PE: true
                                                                                                                                                  • Associated: 00000007.00000002.2414712056.0000000000A00000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A1F000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A24000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414797468.0000000000A25000.00000080.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414816674.0000000000A27000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_7_2_a00000_netconn_properties.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: EncodePointer
                                                                                                                                                  • String ID: MOC$RCC
                                                                                                                                                  • API String ID: 2118026453-2084237596
                                                                                                                                                  • Opcode ID: 7bf01e5b2ff28c37768e309c852700ee2d72555fdb67c88911defb90c05292ab
                                                                                                                                                  • Instruction ID: 04bba430789038dfd35f559c628660f122757f047f9eef5673b4483bd7947016
                                                                                                                                                  • Opcode Fuzzy Hash: 7bf01e5b2ff28c37768e309c852700ee2d72555fdb67c88911defb90c05292ab
                                                                                                                                                  • Instruction Fuzzy Hash: B2417771D0060DAFCF15CFA4E981AEEBBB6BF08301F188198FA056A291D33599A1DF51
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00A011D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • std::_Xinvalid_argument.LIBCPMT ref: 00A011D5
                                                                                                                                                    • Part of subcall function 00A03626: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00A03632
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 00000007.00000002.2414728783.0000000000A01000.00000040.00000001.01000000.00000021.sdmp, Offset: 00A00000, based on PE: true
                                                                                                                                                  • Associated: 00000007.00000002.2414712056.0000000000A00000.00000002.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A1F000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414728783.0000000000A24000.00000040.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414797468.0000000000A25000.00000080.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  • Associated: 00000007.00000002.2414816674.0000000000A27000.00000004.00000001.01000000.00000021.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_7_2_a00000_netconn_properties.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Xinvalid_argumentstd::_std::invalid_argument::invalid_argument
                                                                                                                                                  • String ID: %04x$string too long
                                                                                                                                                  • API String ID: 1997705970-2098177902
                                                                                                                                                  • Opcode ID: 048f4f8e7fc7376133e81cc5b006235c4afe11d397b7b92a239620ee1fae7008
                                                                                                                                                  • Instruction ID: 6e711423699f4d00a878e7f8ce1bf4f42706d0748ffb83e3d209be593f94cf31
                                                                                                                                                  • Opcode Fuzzy Hash: 048f4f8e7fc7376133e81cc5b006235c4afe11d397b7b92a239620ee1fae7008
                                                                                                                                                  • Instruction Fuzzy Hash: 77019672E0021DABCB14DF98ED42AEFB7B9FB48350F150169E90597381EA75AA40C7A1
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Execution Graph

                                                                                                                                                  Execution Coverage:7.5%
                                                                                                                                                  Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                  Signature Coverage:3.3%
                                                                                                                                                  Total number of Nodes:90
                                                                                                                                                  Total number of Limit Nodes:2
                                                                                                                                                  execution_graph 801 2694b0 802 2694c8 VirtualProtect VirtualProtect 801->802 804 26a06c 802->804 804->804 856 262560 857 2617f7 5 API calls 856->857 858 262571 857->858 859 2617f7 5 API calls 858->859 860 26257b 859->860 865 2611b0 6E39D590 866 2611c0 865->866 867 261227 6F8233D0 866->867 868 261210 74F84C80 866->868 870 2617f7 5 API calls 867->870 868->866 868->867 871 26128e 870->871 876 2611c0 880 2611de 876->880 877 261227 6F8233D0 881 2617f7 5 API calls 877->881 878 261210 74F84C80 878->877 878->880 880->877 880->878 882 26128e 881->882 805 261a4d 806 261a59 ___scrt_is_nonwritable_in_current_image 805->806 821 261c89 806->821 808 261a60 809 261bb9 808->809 816 261a8a ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 808->816 831 261f77 IsProcessorFeaturePresent 809->831 811 261bc0 74F94380 812 261bc6 811->812 835 261eb1 812->835 814 261aa9 ___scrt_uninitialize_crt 816->814 825 261520 816->825 822 261c92 821->822 839 262214 IsProcessorFeaturePresent 822->839 824 261c9e ___scrt_uninitialize_crt 824->808 827 261602 825->827 841 2617f7 827->841 828 261769 829 262097 GetModuleHandleW 828->829 830 261b51 829->830 830->811 830->814 832 261f8d 831->832 833 262038 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 832->833 834 262083 833->834 834->811 836 261ec7 835->836 838 261bd4 __scrt_common_main_seh 836->838 849 261e64 GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter 836->849 840 262238 839->840 840->824 842 261800 IsProcessorFeaturePresent 841->842 843 2617ff 841->843 845 261842 842->845 843->828 848 261805 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 845->848 847 261925 847->828 848->847 849->838 861 2694ab 863 2694c8 VirtualProtect VirtualProtect 861->863 864 26a06c 863->864 864->864 872 261a3b 875 2620d9 SetUnhandledExceptionFilter 872->875 874 261a40 875->874 850 261b88 851 262097 GetModuleHandleW 850->851 852 261b90 851->852 853 261b94 852->853 854 261eb1 ___security_init_cookie 4 API calls 852->854 855 261bd4 __scrt_common_main_seh 854->855 883 261988 884 261990 883->884 885 261995 74F95420 884->885 886 2619a0 885->886 900 261cc2 886->900 888 261a13 ___scrt_uninitialize_crt 889 261f77 4 API calls 888->889 899 261a2a 888->899 890 261a32 889->890 891 2619b0 __RTC_Initialize 891->888 906 261f09 RtlInitializeSListHead 891->906 893 2619df 894 2619e8 75012870 893->894 895 2619f3 893->895 894->895 907 261f18 895->907 897 261a02 898 261a07 74F94B50 897->898 898->888 901 261cd2 900->901 902 261cce 900->902 903 261f77 4 API calls 901->903 905 261cdf ___scrt_release_startup_lock 901->905 902->891 904 261d48 903->904 905->891 906->893 908 261f29 907->908 909 261f30 908->909 910 261f77 4 API calls 908->910 909->897 911 261f38 910->911

                                                                                                                                                  Callgraph

                                                                                                                                                  • Executed
                                                                                                                                                  • Not Executed
                                                                                                                                                  • Opacity -> Relevance
                                                                                                                                                  • Disassembly available
                                                                                                                                                  callgraph 0 Function_00261927 45 Function_002610F0 0->45 67 Function_00261BD9 0->67 1 Function_00261E22 2 Function_00261520 28 Function_00261010 2->28 41 Function_002617F7 2->41 56 Function_002617C0 2->56 61 Function_00261957 2->61 3 Function_002621A0 4 Function_00261DAE 5 Function_002694AB 6 Function_00263B33 7 Function_002694B0 8 Function_002611B0 8->41 9 Function_00261EB1 31 Function_00261E64 9->31 10 Function_00261F3C 11 Function_002624BA 12 Function_0026213B 13 Function_00261A3B 49 Function_00261EFC 13->49 68 Function_002620D9 13->68 14 Function_00261F39 15 Function_00261805 16 Function_00261F03 17 Function_00261000 18 Function_00261080 19 Function_00261988 19->14 19->16 21 Function_00261F09 19->21 25 Function_00261F15 19->25 30 Function_00261F18 19->30 40 Function_00261F77 19->40 47 Function_00261EFF 19->47 19->49 51 Function_00261F42 19->51 52 Function_00261CC2 19->52 53 Function_00262143 19->53 58 Function_00261E4F 19->58 65 Function_00261F5F 19->65 20 Function_00261B88 20->9 23 Function_00262097 20->23 22 Function_00261C89 24 Function_00262214 22->24 22->25 26 Function_00261C13 27 Function_00261110 27->45 28->17 29 Function_00261090 29->61 30->40 32 Function_00261965 32->61 33 Function_002620E5 34 Function_002621E5 34->11 35 Function_00262560 35->41 36 Function_0026216F 37 Function_00261F6B 38 Function_002623E8 39 Function_00263569 40->12 41->15 42 Function_00261B74 43 Function_00261770 43->61 44 Function_00261170 46 Function_00261F71 48 Function_00263AFF 50 Function_00261DFA 50->25 51->10 51->17 52->38 52->40 54 Function_002611C0 54->41 55 Function_00262540 56->17 57 Function_00261DC1 58->1 59 Function_00261A4D 59->2 59->3 59->9 59->22 59->23 59->37 59->40 59->46 59->50 60 Function_00261D49 59->60 62 Function_00261C57 59->62 66 Function_00261DDD 59->66 60->3 60->26 62->38 63 Function_00261050 64 Function_002610D0 66->38

                                                                                                                                                  Executed Functions

                                                                                                                                                  Function 002694B0 Relevance: 3.9, APIs: 2, Instructions: 881memoryCOMMON
                                                                                                                                                  Download Yara Rule
                                                                                                                                                  APIs
                                                                                                                                                  • VirtualProtect.KERNELBASE(-00001000,00001000,00000004,?,00000000), ref: 0026A04F
                                                                                                                                                  • VirtualProtect.KERNELBASE(-00001000,00001000), ref: 0026A064
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 0000000A.00000002.2415778864.0000000000269000.00000080.00000001.01000000.00000022.sdmp, Offset: 00260000, based on PE: true
                                                                                                                                                  • Associated: 0000000A.00000002.2415661276.0000000000260000.00000002.00000001.01000000.00000022.sdmpDownload File
                                                                                                                                                  • Associated: 0000000A.00000002.2415695027.0000000000261000.00000040.00000001.01000000.00000022.sdmpDownload File
                                                                                                                                                  • Associated: 0000000A.00000002.2415695027.0000000000265000.00000040.00000001.01000000.00000022.sdmpDownload File
                                                                                                                                                  • Associated: 0000000A.00000002.2415695027.0000000000268000.00000040.00000001.01000000.00000022.sdmpDownload File
                                                                                                                                                  • Associated: 0000000A.00000002.2415796907.000000000026B000.00000004.00000001.01000000.00000022.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_10_2_260000_registers.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ProtectVirtual
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 544645111-0
                                                                                                                                                  • Opcode ID: b474d2028b8914171b7bd712012b4bfc14c520154d885e64ada5daf5155cabef
                                                                                                                                                  • Instruction ID: b323047565b97943e9c2ff572bce646d59693f78bfe22307855bff91ec5c9049
                                                                                                                                                  • Opcode Fuzzy Hash: b474d2028b8914171b7bd712012b4bfc14c520154d885e64ada5daf5155cabef
                                                                                                                                                  • Instruction Fuzzy Hash: 1072DF315283558FD324CF28C88026ABBE5FF8A344F154A2DE9E5CB351EB71D995CB82
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00261B88 Relevance: 1.5, APIs: 1, Instructions: 22COMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  • Executed
                                                                                                                                                  • Not Executed
                                                                                                                                                  control_flow_graph 153 261b88-261b92 call 262097 156 261bc6-261bd4 call 26245a call 261eb1 __scrt_common_main_seh 153->156 157 261b94-261b98 153->157 158 261b9f-261bb8 157->158 159 261b9a call 262478 157->159 159->158
                                                                                                                                                  APIs
                                                                                                                                                    • Part of subcall function 00262097: GetModuleHandleW.KERNEL32(00000000,00261B51), ref: 00262099
                                                                                                                                                  • ___security_init_cookie.LIBCMT ref: 00261BCF
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 0000000A.00000002.2415695027.0000000000261000.00000040.00000001.01000000.00000022.sdmp, Offset: 00260000, based on PE: true
                                                                                                                                                  • Associated: 0000000A.00000002.2415661276.0000000000260000.00000002.00000001.01000000.00000022.sdmpDownload File
                                                                                                                                                  • Associated: 0000000A.00000002.2415695027.0000000000265000.00000040.00000001.01000000.00000022.sdmpDownload File
                                                                                                                                                  • Associated: 0000000A.00000002.2415695027.0000000000268000.00000040.00000001.01000000.00000022.sdmpDownload File
                                                                                                                                                  • Associated: 0000000A.00000002.2415778864.0000000000269000.00000080.00000001.01000000.00000022.sdmpDownload File
                                                                                                                                                  • Associated: 0000000A.00000002.2415796907.000000000026B000.00000004.00000001.01000000.00000022.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_10_2_260000_registers.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: HandleModule___security_init_cookie
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 1525027140-0
                                                                                                                                                  • Opcode ID: 081fd81bea330b2ae3a87e6564303e74405b5fb521175a5e9dbe2dc4b9816b93
                                                                                                                                                  • Instruction ID: eb32889e03913b09d6002cb05922cc943c93db3534a06dde4a7228520251d750
                                                                                                                                                  • Opcode Fuzzy Hash: 081fd81bea330b2ae3a87e6564303e74405b5fb521175a5e9dbe2dc4b9816b93
                                                                                                                                                  • Instruction Fuzzy Hash: A3E0DF7292468ACFDF20AFD4D4023ECBBB1AF40364F140556E861322A1DB3568B5CA50
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Non-executed Functions

                                                                                                                                                  Function 00261F77 Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  APIs
                                                                                                                                                  • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00261F83
                                                                                                                                                  • IsDebuggerPresent.KERNEL32 ref: 0026204F
                                                                                                                                                  • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0026206F
                                                                                                                                                  • UnhandledExceptionFilter.KERNEL32(?), ref: 00262079
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 0000000A.00000002.2415695027.0000000000261000.00000040.00000001.01000000.00000022.sdmp, Offset: 00260000, based on PE: true
                                                                                                                                                  • Associated: 0000000A.00000002.2415661276.0000000000260000.00000002.00000001.01000000.00000022.sdmpDownload File
                                                                                                                                                  • Associated: 0000000A.00000002.2415695027.0000000000265000.00000040.00000001.01000000.00000022.sdmpDownload File
                                                                                                                                                  • Associated: 0000000A.00000002.2415695027.0000000000268000.00000040.00000001.01000000.00000022.sdmpDownload File
                                                                                                                                                  • Associated: 0000000A.00000002.2415778864.0000000000269000.00000080.00000001.01000000.00000022.sdmpDownload File
                                                                                                                                                  • Associated: 0000000A.00000002.2415796907.000000000026B000.00000004.00000001.01000000.00000022.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_10_2_260000_registers.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 254469556-0
                                                                                                                                                  • Opcode ID: 8ab473aa370706576e6d56ce6722b164ad449390e7461cbb4bbb5488fbcb62db
                                                                                                                                                  • Instruction ID: 4c6eaa8817ef27e1881b1d8673f38af5affcb8339aa170ad535dd25d9f72104e
                                                                                                                                                  • Opcode Fuzzy Hash: 8ab473aa370706576e6d56ce6722b164ad449390e7461cbb4bbb5488fbcb62db
                                                                                                                                                  • Instruction Fuzzy Hash: 04311A75D15219DBDF10DFA4D9897CDBBB8AF08300F1041AAE40DA7250EB719B898F04
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00261520 Relevance: 2.7, Strings: 2, Instructions: 166COMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  • Executed
                                                                                                                                                  • Not Executed
                                                                                                                                                  control_flow_graph 329 261520-261722 call 2612a0 call 2617c0 call 261010 336 261756-26176c call 2617f7 329->336 337 261724-261734 329->337 338 261736-261744 337->338 339 26174c-261753 call 261957 337->339 338->339 341 261746 338->341 339->336 341->339
                                                                                                                                                  Strings
                                                                                                                                                  • {"sidt": %d, "sgdt": %d, "rdtsc": [%I64d, %I64d, %I64d, %I64d], "rdtsc_vmexit": [%I64d, %I64d, %I64d, %I64d], "cpu_vendor_id":[%d,%d,%d,%d], "cpu_branding":"%s", "cpuid_0":[%d,%d,%d,%d], "cpuid_1":[%d,%d,%d,%d]}, xrefs: 002616F2
                                                                                                                                                  • %s, xrefs: 0026170B
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 0000000A.00000002.2415695027.0000000000261000.00000040.00000001.01000000.00000022.sdmp, Offset: 00260000, based on PE: true
                                                                                                                                                  • Associated: 0000000A.00000002.2415661276.0000000000260000.00000002.00000001.01000000.00000022.sdmpDownload File
                                                                                                                                                  • Associated: 0000000A.00000002.2415695027.0000000000265000.00000040.00000001.01000000.00000022.sdmpDownload File
                                                                                                                                                  • Associated: 0000000A.00000002.2415695027.0000000000268000.00000040.00000001.01000000.00000022.sdmpDownload File
                                                                                                                                                  • Associated: 0000000A.00000002.2415778864.0000000000269000.00000080.00000001.01000000.00000022.sdmpDownload File
                                                                                                                                                  • Associated: 0000000A.00000002.2415796907.000000000026B000.00000004.00000001.01000000.00000022.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_10_2_260000_registers.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: F8233
                                                                                                                                                  • String ID: %s${"sidt": %d, "sgdt": %d, "rdtsc": [%I64d, %I64d, %I64d, %I64d], "rdtsc_vmexit": [%I64d, %I64d, %I64d, %I64d], "cpu_vendor_id":[%d,%d,%d,%d], "cpu_branding":"%s", "cpuid_0":[%d,%d,%d,%d], "cpuid_1":[%d,%d,%d,%d]}
                                                                                                                                                  • API String ID: 1213906786-1597640580
                                                                                                                                                  • Opcode ID: 5b70a9938895faa576643a2728b536ce07049651e1aa5dc1dc63025e56741f8f
                                                                                                                                                  • Instruction ID: fe6b1c789fa41cde2f0359b70a3591dfed64ddcbb048dbdee5d130ff5b07cae8
                                                                                                                                                  • Opcode Fuzzy Hash: 5b70a9938895faa576643a2728b536ce07049651e1aa5dc1dc63025e56741f8f
                                                                                                                                                  • Instruction Fuzzy Hash: 8C511672508380AFDB258F64D880B9BFBE6FF89310F10892EF69986211D3729464DF53
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 002611B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  • Executed
                                                                                                                                                  • Not Executed
                                                                                                                                                  control_flow_graph 228 2611b0-2611dc 6E39D590 230 2611f3-261201 228->230 231 2611de-2611f1 228->231 232 261204-26120b 230->232 231->232 233 26120d 232->233 234 26122a-261235 232->234 237 261210-261220 74F84C80 233->237 235 261237-26124c 234->235 236 26124e-26125c 234->236 238 26125e-261291 6F8233D0 call 2617f7 235->238 236->238 239 261227 237->239 240 261222-261225 237->240 239->234 240->237 240->239
                                                                                                                                                  APIs
                                                                                                                                                  • 6E39D590.MSVCP140(string too long,00261519,2ED112C8), ref: 002611B5
                                                                                                                                                  • 74F84C80.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 00261215
                                                                                                                                                  • 6F8233D0.VCRUNTIME140(?,?,?), ref: 00261272
                                                                                                                                                  Strings
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 0000000A.00000002.2415695027.0000000000261000.00000040.00000001.01000000.00000022.sdmp, Offset: 00260000, based on PE: true
                                                                                                                                                  • Associated: 0000000A.00000002.2415661276.0000000000260000.00000002.00000001.01000000.00000022.sdmpDownload File
                                                                                                                                                  • Associated: 0000000A.00000002.2415695027.0000000000265000.00000040.00000001.01000000.00000022.sdmpDownload File
                                                                                                                                                  • Associated: 0000000A.00000002.2415695027.0000000000268000.00000040.00000001.01000000.00000022.sdmpDownload File
                                                                                                                                                  • Associated: 0000000A.00000002.2415778864.0000000000269000.00000080.00000001.01000000.00000022.sdmpDownload File
                                                                                                                                                  • Associated: 0000000A.00000002.2415796907.000000000026B000.00000004.00000001.01000000.00000022.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_10_2_260000_registers.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: D590F8233
                                                                                                                                                  • String ID: string too long
                                                                                                                                                  • API String ID: 530822383-2556327735
                                                                                                                                                  • Opcode ID: 38c374aa804fc99589b1cf23bcc7e1d52b66ae6ef39d157b4c5dec47b83c60a9
                                                                                                                                                  • Instruction ID: 458c22b68722674a2cbe81a0696110df088abfab3466ae6721c9c9da5a3d894d
                                                                                                                                                  • Opcode Fuzzy Hash: 38c374aa804fc99589b1cf23bcc7e1d52b66ae6ef39d157b4c5dec47b83c60a9
                                                                                                                                                  • Instruction Fuzzy Hash: 5421B071A102259FCB08DF68D8D85AEFBB4FF49300B0545ADDD15EB305E7B0AA64CB91
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%

                                                                                                                                                  Function 00261988 Relevance: 6.1, APIs: 4, Instructions: 56COMMON
                                                                                                                                                  Download Yara Rule

                                                                                                                                                  Control-flow Graph

                                                                                                                                                  APIs
                                                                                                                                                  • 74F95420.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001), ref: 00261996
                                                                                                                                                  • __RTC_Initialize.LIBCMT ref: 002619BA
                                                                                                                                                    • Part of subcall function 00261F09: RtlInitializeSListHead.NTDLL(002653D0), ref: 00261F0E
                                                                                                                                                  • 75012870.API-MS-WIN-CRT-MATH-L1-1-0(Function_00001EFC), ref: 002619ED
                                                                                                                                                  • 74F94B50.API-MS-WIN-CRT-LOCALE-L1-1-0(00000000), ref: 00261A08
                                                                                                                                                  Memory Dump Source
                                                                                                                                                  • Source File: 0000000A.00000002.2415695027.0000000000261000.00000040.00000001.01000000.00000022.sdmp, Offset: 00260000, based on PE: true
                                                                                                                                                  • Associated: 0000000A.00000002.2415661276.0000000000260000.00000002.00000001.01000000.00000022.sdmpDownload File
                                                                                                                                                  • Associated: 0000000A.00000002.2415695027.0000000000265000.00000040.00000001.01000000.00000022.sdmpDownload File
                                                                                                                                                  • Associated: 0000000A.00000002.2415695027.0000000000268000.00000040.00000001.01000000.00000022.sdmpDownload File
                                                                                                                                                  • Associated: 0000000A.00000002.2415778864.0000000000269000.00000080.00000001.01000000.00000022.sdmpDownload File
                                                                                                                                                  • Associated: 0000000A.00000002.2415796907.000000000026B000.00000004.00000001.01000000.00000022.sdmpDownload File
                                                                                                                                                  Joe Sandbox IDA Plugin
                                                                                                                                                  • Snapshot File: hcaresult_10_2_260000_registers.jbxd
                                                                                                                                                  Similarity
                                                                                                                                                  • API ID: Initialize$75012870F95420HeadList
                                                                                                                                                  • String ID:
                                                                                                                                                  • API String ID: 4048121495-0
                                                                                                                                                  • Opcode ID: a7ace0f63d0612e2965310b5d52efbb6a8082b4ce91dd8765ac20e4cc2518613
                                                                                                                                                  • Instruction ID: 98e21131c33c9b044483eb222f69da8101c37cfd508227608c128a7fdcf3b351
                                                                                                                                                  • Opcode Fuzzy Hash: a7ace0f63d0612e2965310b5d52efbb6a8082b4ce91dd8765ac20e4cc2518613
                                                                                                                                                  • Instruction Fuzzy Hash: 9F016225A31B0398DA243BF56907A4E12481F51755F2C8950FC48968C3EF1AF8F88C73
                                                                                                                                                  Uniqueness

                                                                                                                                                  Uniqueness Score: -1.00%